Medium · 5.3 CVE-2026-22560 EUVD-2026-21500GHSA-8fhh-33x2-c7c5

An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating param…

Published Apr 10, 2026 · Updated Apr 14, 2026 · Assigned by hackerone

Description

An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint.

Affected products

Vendor	Product	Affected	Fixed
Rocket.Chat	Rocket.Chat	8.4.0 – < 8.4.0	8.4.0

References

https://hackerone.com/reports/3418031
https://github.com/RocketChat/Rocket.Chat/pull/38994