🔺Severity: Critical
👽 Reporter: 0jayden
⭐️ Reputation: 213
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-06-26
⏰ Disclosed: 2026-07-27 16:37:05
📝 Summary: The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the
samlp:Response or saml:Assertion. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP certificate, and gain unauthorized access to the system.📂 Report JSON File: 3827674
@hackeronereports