CVE-2026-28514

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28514", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T20:57:47.710Z", "datePublished": "2026-03-06T17:35:01.841Z", "dateUpdated": "2026-03-11T03:56:35.920Z"}, "containers": {"cna": {"title": "Rocket.Chat: Users can login with any password via the EE ddp-streamer-service", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf"}, {"name": "https://github.com/RocketChat/Rocket.Chat/pull/37143", "tags": ["x_refsource_MISC"], "url": "https://github.com/RocketChat/Rocket.Chat/pull/37143"}, {"name": "https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07", "tags": ["x_refsource_MISC"], "url": "https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07"}], "affected": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"version": "< 7.8.6", "status": "affected"}, {"version": "< 7.9.8", "status": "affected"}, {"version": "< 7.10.7", "status": "affected"}, {"version": "< 7.11.4", "status": "affected"}, {"version": "< 7.12.4", "status": "affected"}, {"version": "< 7.13.3", "status": "affected"}, {"version": "< 8.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T17:35:01.841Z"}, "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0."}], "source": {"advisory": "GHSA-w6vw-mrgv-69vf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-28514"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T03:56:35.920Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28514", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T14:57:13.123793Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T14:57:17.148Z"}}], "cna": {"title": "Rocket.Chat: Users can login with any password via the EE ddp-streamer-service", "source": {"advisory": "GHSA-w6vw-mrgv-69vf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "RocketChat", "product": "Rocket.Chat", "versions": [{"status": "affected", "version": "< 7.8.6"}, {"status": "affected", "version": "< 7.9.8"}, {"status": "affected", "version": "< 7.10.7"}, {"status": "affected", "version": "< 7.11.4"}, {"status": "affected", "version": "< 7.12.4"}, {"status": "affected", "version": "< 7.13.3"}, {"status": "affected", "version": "< 8.0.0"}]}], "references": [{"url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf", "name": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/RocketChat/Rocket.Chat/pull/37143", "name": "https://github.com/RocketChat/Rocket.Chat/pull/37143", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07", "name": "https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T17:35:01.841Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28514", "state": "PUBLISHED", "dateUpdated": "2026-03-11T03:56:35.920Z", "dateReserved": "2026-02-27T20:57:47.710Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T17:35:01.841Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Rocket.Chat", "vendor": "RocketChat", "versions": [{"status": "affected", "version": "< 7.8.6"}, {"status": "affected", "version": "< 7.9.8"}, {"status": "affected", "version": "< 7.10.7"}, {"status": "affected", "version": "< 7.11.4"}, {"status": "affected", "version": "< 7.12.4"}, {"status": "affected", "version": "< 7.13.3"}, {"status": "affected", "version": "< 8.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDF1710B-451A-45DE-92B2-5EB0DB847964", "versionEndExcluding": "7.8.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "624B69A1-3489-4BC3-9A47-AC5AC4743CE8", "versionEndExcluding": "7.9.8", "versionStartIncluding": "7.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A1AA90D-199C-4AA9-96CA-3CFD7E043572", "versionEndExcluding": "7.10.7", "versionStartIncluding": "7.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A10B0BA-17CC-4AFF-A2F4-20E5252EB0F1", "versionEndExcluding": "7.11.4", "versionStartIncluding": "7.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "B33BA4A7-71F3-42EE-A29B-936AA166CA45", "versionEndExcluding": "7.12.4", "versionStartIncluding": "7.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "50874BCF-361F-416D-9A32-E6C43E12E218", "versionEndExcluding": "7.13.3", "versionStartIncluding": "7.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:8.0.0:rc0:*:*:*:*:*:*", "matchCriteriaId": "92CEECD0-CC4A-4798-9139-F14FEE8608FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:8.0.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "BBCB3AD1-0707-49FB-B837-811D87494991", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:8.0.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C6204C2-7FFC-4D41-A623-D19A47469A0B", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:8.0.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "6D9076FE-EDA5-49E8-BB23-2B3FF17F70F5", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:8.0.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "140941C3-08BF-4920-AA63-ED00DE58AF66", "vulnerable": true}, {"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:8.0.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "3DAE103A-461A-4379-B322-577711AA0EC0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0, a critical authentication bypass vulnerability exists in Rocket.Chat's account service used in the ddp-streamer micro service that allows an attacker to log in to the service as any user with a password set, using any arbitrary password. The vulnerability stems from a missing await keyword when calling an asynchronous password validation function, causing a Promise object (which is always truthy) to be evaluated instead of the actual boolean validation result. This may lead to account takeover of any user whose username is known or guessable. This issue has been patched in versions 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0."}, {"lang": "es", "value": "Rocket.Chat es una plataforma de comunicaciones de c\u00f3digo abierto, segura y totalmente personalizable. Antes de las versiones 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3 y 8.0.0, existe una vulnerabilidad cr\u00edtica de omisi\u00f3n de autenticaci\u00f3n en el servicio de cuentas de Rocket.Chat utilizado en el microservicio ddp-streamer que permite a un atacante iniciar sesi\u00f3n en el servicio como cualquier usuario con una contrase\u00f1a establecida, utilizando cualquier contrase\u00f1a arbitraria. La vulnerabilidad se deriva de la ausencia de la palabra clave await al llamar a una funci\u00f3n as\u00edncrona de validaci\u00f3n de contrase\u00f1a, lo que provoca que se eval\u00fae un objeto Promise (que siempre es truthy) en lugar del resultado de validaci\u00f3n booleano real. Esto puede llevar a la toma de control de la cuenta de cualquier usuario cuyo nombre de usuario sea conocido o adivinable. Este problema ha sido parcheado en las versiones 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3 y 8.0.0."}], "id": "CVE-2026-28514", "lastModified": "2026-06-17T10:28:46.637", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28514", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-06T18:16:19.103", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/RocketChat/Rocket.Chat/commit/7d89aae0b1bd08e82b02ceab4c180b430e2c6f07"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/RocketChat/Rocket.Chat/pull/37143"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-w6vw-mrgv-69vf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.8.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.9.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.10.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.11.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.12.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.13.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Rocket.Chat", "source": "cna", "vendor": "RocketChat"}, "product": "rocket.chat", "vendor": "rocketchat"}], "analysis": {"en": {"generated_at": "2026-04-16T11:17:40.388280+00:00", "value": {"mitigation_remediation": ["Apply the latest Rocket.Chat patch or upgrade to any release newer than 7.8.6 (including 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, 8.0.0 or later).", "If an immediate upgrade is not possible, restrict access to the ddp-streamer service by firewall rules or IP\u2011whitelisting to trusted administrators and monitor authentication logs for suspicious activity.", "Remove or disable the ddp-streamer microservice from non\u2011essential deployments until the vulnerability can be patched, thereby eliminating the critical authentication bypass path."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass (Account Takeover)"}, "threat_synthesis": {"affected_systems": "All Rocket.Chat instances running a version earlier than the patched releases 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3 or 8.0.0 are affected. The issue resides specifically in the Enterprise Edition ddp-streamer microservice.\n\n", "description_and_impact": "A missing await keyword in Rocket.Chat\u2019s ddp-streamer microservice causes the asynchronous password validator to return a Promise object that is always truthy. As a result, any submitted password is accepted for any username that has a password set, allowing an attacker to authenticate as that user. Because the bypass removes the need for a correct password, the vulnerability can lead to full account takeover, compromising confidential user data and sensitive communications. The flaw is a classic example of improper authentication, mapped to CWE\u2011287.", "risk_and_exploitability": "The CVSS score is 9.3, classifying the flaw as critical, while the EPSS score is less than 1%, indicating a low current probability of exploitation. It is not listed in CISA\u2019s KEV catalog. The likely attack vector is remote via the exposed authentication endpoint of the ddp-streamer service; based on the description, it is inferred that an attacker can perform the bypass by supplying any password after knowing a valid username."}}}}, "created": "2026-03-09T10:07:15.549391+00:00", "updated": "2026-04-16T11:30:15.896883+00:00", "vendors": ["rocketchat", "rocketchat$PRODUCT$rocket.chat"]}