RocketChat Rocket.Chat up to 8.4.x OAuth Access Token /oauth/token data query logic injection

Summaryinfo

A vulnerability labeled as critical has been found in RocketChat Rocket.Chat up to 8.4.x. Impacted is an unknown function of the file /oauth/token of the component OAuth Access Token Handler. Executing a manipulation can lead to data query logic injection. This vulnerability is tracked as CVE-2026-45689. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in RocketChat Rocket.Chat up to 8.4.x. It has been declared as critical. This vulnerability affects an unknown part of the file /oauth/token of the component OAuth Access Token Handler. The manipulation with an unknown input leads to a data query logic injection vulnerability. The CWE definition for the vulnerability is CWE-943. The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with MongoDB query operators to /oauth/token. The Rocket.Chat OAuth2 server does not validate that grant parameters are strings before forwarding them to findOne({...}) against the oauth_apps and oauth_access_tokens collections, so an attacker substitutes {"$ne": null} for client_id, client_secret, and refresh_token and receives a freshly minted {access_token, refresh_token} pair bound to whichever user's refresh token Mongo returned first. The resulting access token is a first-class bearer credential against the full /api/v1/* surface as that user. By iterating with $nin / $regex operators the attacker walks the entire oauth_access_tokens collection, collecting one fresh access token per user per request. If any matched token belongs to an admin, the stolen bearer gives full admin API access (including Apps-Engine app installation, i.e. server-side code execution). No account, credentials, userId, or prior interaction with the instance are required. This vulnerability is fixed in 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11.

The advisory is available at github.com. This vulnerability was named CVE-2026-45689 since 05/13/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 7.10.11, 7.13.7, 8.0.5, 8.1.4, 8.2.3, 8.3.3, 8.4.1 or 8.5.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Chat Software

Vendor

• RocketChat

Name

• Rocket.Chat

Version

• 7.10.0
• 7.10.1
• 7.10.2
• 7.10.3
• 7.10.4
• 7.10.5
• 7.10.6
• 7.10.7
• 7.10.8
• 7.10.9
• 7.10.10
• 7.13.0
• 7.13.1
• 7.13.2
• 7.13.3
• 7.13.4
• 7.13.5
• 7.13.6
• 8.0
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.1
• 8.1.0
• 8.1.1
• 8.1.2
• 8.1.3
• 8.2
• 8.2.0
• 8.2.1
• 8.2.2
• 8.3
• 8.3.0
• 8.3.1
• 8.3.2
• 8.4
• 8.4.0

License

• free

Website

• Product: https://github.com/RocketChat/Rocket.Chat/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion