RocketChat Rocket.Chat up to 8.4.x OAuth Access Token session expiration

Summaryinfo

A vulnerability has been found in RocketChat Rocket.Chat up to 8.4.x and classified as problematic. This impacts an unknown function of the component OAuth Access Token Handler. Performing a manipulation results in session expiration. This vulnerability is known as CVE-2026-49277. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in RocketChat Rocket.Chat up to 8.4.x. This affects an unknown part of the component OAuth Access Token Handler. The manipulation with an unknown input leads to a session expiration vulnerability. CWE is classifying the issue as CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat does not revoke OAuth bearer or refresh tokens when a user is deactivated. A deactivated user can continue using an existing OAuth access token, and can also mint a fresh access token from an existing refresh token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-49277 since 05/28/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 7.10.12, 7.13.8, 8.0.6, 8.1.5, 8.2.4, 8.3.4, 8.4.2 or 8.5.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Chat Software

Vendor

• RocketChat

Name

• Rocket.Chat

Version

• 7.10.0
• 7.10.1
• 7.10.2
• 7.10.3
• 7.10.4
• 7.10.5
• 7.10.6
• 7.10.7
• 7.10.8
• 7.10.9
• 7.10.10
• 7.10.11
• 7.13.0
• 7.13.1
• 7.13.2
• 7.13.3
• 7.13.4
• 7.13.5
• 7.13.6
• 7.13.7
• 8.0
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 8.1
• 8.1.0
• 8.1.1
• 8.1.2
• 8.1.3
• 8.1.4
• 8.2
• 8.2.0
• 8.2.1
• 8.2.2
• 8.2.3
• 8.3
• 8.3.0
• 8.3.1
• 8.3.2
• 8.3.3
• 8.4
• 8.4.0
• 8.4.1

License

• free

Website

• Product: https://github.com/RocketChat/Rocket.Chat/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion