Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer

The primary impact of CVE-2026-30831 is the potential for unauthorized access to Rocket.Chat accounts. By exploiting this vulnerability, an attacker can bypass the standard Meteor login flow, circumventing 2FA and logging in as a legitimate user, even if their account has been deactivated. This could lead to data breaches, including access to sensitive conversations, files, and user information stored within the Rocket.Chat instance. The attacker could also potentially use the compromised account to escalate privileges or gain access to other systems within the organization, depending on the account's permissions and network configuration. This vulnerability highlights the importance of properly enforcing authentication controls, even in custom or extended functionalities like the DDP Streamer service.

Organizations heavily reliant on Rocket.Chat for internal communications, particularly those with strict security requirements or handling sensitive data, are at significant risk. Environments utilizing custom integrations or extensions that interact with the DDP Streamer service are also at increased risk, as these may introduce additional attack vectors.

• nodejs / server: Monitor Rocket.Chat logs for unusual login attempts, particularly those originating from unexpected IP addresses or involving deactivated user accounts. Use journalctl -u rocket.chat to filter for login-related events. • generic web: Use curl -I <rocket.chat_url>/api/v1/login to check the response headers for any unusual behavior or unexpected authentication flows. Examine access logs for suspicious requests targeting the login endpoint. • database (mongodb): Use mongosh to query the Rocket.chat database for deactivated user accounts with recent login activity. Look for anomalies in user authentication logs.

1. 2026-03-06Disclosure

   disclosure

1. Reserviert2026-03-05
2. Veröffentlicht2026-03-06
3. Geändert2026-03-11
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-30831 is to upgrade Rocket.Chat to a patched version. Versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0 contain the necessary fixes. If immediate upgrade is not possible, consider temporarily restricting access to the DDP Streamer service or implementing stricter input validation on the Account.login endpoint. Review Rocket.Chat's access control lists (ACLs) to ensure that deactivated user accounts have minimal privileges. After upgrading, confirm the fix by attempting to log in with a deactivated user account and verifying that the login attempt is rejected.