PT-2026-31988 · Rocket.Chat · Rocket.Chat

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-22560

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.4.0

Description An open redirect issue exists in Rocket.Chat that allows redirection to arbitrary URLs. This is achieved by manipulating parameters within a SAML endpoint.

Recommendations Update to version 8.4.0 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-22560

Affected Products

Rocket.Chat

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-22560 · Security Note
• https://github.com/RocketChat/Rocket.Chat/pull/38994 · Note
• https://twitter.com/CVEnew/status/2042710220636406077 · Twitter Post
• https://hackerone.com/reports/3418031 · Note