A critical authentication bypass vulnerability in Rocket.Chat allows unauthenticated attackers to impersonate any user on the system, posing a severe risk of unauthorized access and data compromise.

This is an improper authentication vulnerability (CWE-287) where the application fails to correctly bind validated SAML signatures to the SAML response. An unauthenticated attacker can exploit this to inject forged identity attributes and gain unauthorized access as any user.

Successful exploitation allows an attacker to gain full control over user accounts, including administrative accounts, leading to complete system compromise. Given the CVSS score of 9.8, this vulnerability represents a critical risk to organizational data integrity and confidentiality. Unauthorized access to internal communications and sensitive documents can result in severe reputational damage and regulatory non-compliance.

Immediate Action: Upgrade to the latest patched version of Rocket.Chat as specified in the vendor security advisory to ensure the SAML signature binding logic is correctly enforced.

Proactive Monitoring: Review authentication and SAML login logs for unusual patterns, such as multiple successful logins from disparate geographical locations or unexpected administrative access events.

Compensating Controls: If immediate patching is not feasible, consider temporarily disabling SAML SSO authentication for the platform and enforcing alternative secure authentication methods.

Public Exploit Available: Unknown

The severity of this vulnerability cannot be overstated, as it provides a direct path to total system takeover without requiring any existing credentials. Organizations must prioritize applying the provided patches across all affected instances immediately to mitigate the risk of account impersonation and unauthorized data access.