CVE-2026-45689

🗓️ 24 Jun 2026 20:57:32Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 28 Views🌐 WEB

Unauthenticated attacker obtains user tokens via NoSQL injection on /oauth/token, enabling full API access.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-45689	24 Jun 202620:57	–	attackerkb
Circl	CVE-2026-45689	24 Jun 202622:18	–	circl
Cvelist	CVE-2026-45689 Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO	24 Jun 202620:57	–	cvelist
EUVD	EUVD-2026-39094	24 Jun 202620:57	–	euvd
NVD	CVE-2026-45689	24 Jun 202621:16	–	nvd
OSV	CVE-2026-45689 Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO	24 Jun 202620:57	–	osv
Positive Technologies	PT-2026-52094	24 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-45689 Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO	24 Jun 202620:57	–	vulnrichment

Vulners

Node

rocketchat rocket.chatRange8.5.0-rc.0–8.5.0

rocketchat rocket.chatRange8.4.0-rc.0–8.4.1

rocketchat rocket.chatRange8.3.0-rc.0–8.3.3

rocketchat rocket.chatRange8.2.0-rc.0–8.2.3

rocketchat rocket.chatRange8.1.0-rc.0–8.1.4

rocketchat rocket.chatRange8.0.0-rc.0–8.0.5

rocketchat rocket.chatRange7.11.0-rc.0–7.13.7

rocketchat rocket.chatRange<7.10.11

[
  {
    "vendor": "RocketChat",
    "product": "Rocket.Chat",
    "versions": [
      {
        "version": ">= 8.5.0-rc.0, < 8.5.0",
        "status": "affected"
      },
      {
        "version": ">= 8.4.0-rc.0, < 8.4.1",
        "status": "affected"
      },
      {
        "version": ">= 8.3.0-rc.0, < 8.3.3",
        "status": "affected"
      },
      {
        "version": ">= 8.2.0-rc.0, < 8.2.3",
        "status": "affected"
      },
      {
        "version": ">= 8.1.0-rc.0, < 8.1.4",
        "status": "affected"
      },
      {
        "version": ">= 8.0.0-rc.0, < 8.0.5",
        "status": "affected"
      },
      {
        "version": ">= 7.11.0-rc.0, < 7.13.7",
        "status": "affected"
      },
      {
        "version": "< 7.10.11",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-8p25-fm45-pjrw

Parameter	Position	Path	Description	CWE
client_id	request body	/oauth/token	Unauthenticated attacker can obtain a valid OAuth access token by sending a POST to /oauth/token with MongoDB operator payload, exploiting lack of validation before findOne against oauth_apps and oauth_access_tokens.	CWE-943
client_secret	request body	/oauth/token	Unauthenticated attacker can obtain a valid OAuth access token by sending a POST to /oauth/token with MongoDB operator payload, exploiting lack of validation before findOne against oauth_apps and oauth_access_tokens.	CWE-943
refresh_token	request body	/oauth/token	Unauthenticated attacker can obtain a valid OAuth access token by sending a POST to /oauth/token with MongoDB operator payload, exploiting lack of validation before findOne against oauth_apps and oauth_access_tokens.	CWE-943

26 Jun 2026 05:16Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.19.1

EPSS0.00308

SSVC

CWE-943