Loading story…
Rocket.Chat disclosed and patched critical authentication flaws in its Enterprise DDP Streamer (ddp-streamer-service) that can enable account takeover and policy bypass. CVE-2026-28514 allows an attacker to authenticate as any user with a password set using an arbitrary password due to an implementation bug in async password validation (a missing await causes a truthy Promise to be treated as successful validation), making exploitation feasible when usernames are known or guessable.
A second issue, CVE-2026-30831, affects the same Enterprise DDP Streamer login path where Account.login fails to enforce 2FA and does not validate account status, allowing 2FA bypass and permitting deactivated users to log in. Rocket.Chat reports fixes across multiple release trains, including patched versions 7.8.6/7.9.8/7.10.7/7.11.4/7.12.4/7.13.3/8.0.0 for CVE-2026-28514 and 7.10.8/7.11.5/7.12.5/7.13.4/8.0.2/8.1.1/8.2.0 for CVE-2026-30831; organizations running affected Enterprise DDP Streamer components should prioritize upgrades to the fixed builds to prevent unauthorized access paths.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Rocket.Chat disclosed vulnerabilities in the enterprise DDP Streamer login path that failed to enforce two-factor authentication and did not validate whether accounts were deactivated. The issues were fixed in versions 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, and 8.2.0.
Rocket.Chat disclosed a critical authentication bypass in its account service used by the enterprise ddp-streamer microservice. The flaw, caused by a missing await in asynchronous password validation, allowed login as any user with an arbitrary password in affected versions before patched releases 7.8.6, 7.9.8, 7.10.7, 7.11.4, 7.12.4, 7.13.3, and 8.0.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat and the Keycloak project patched **CVE-2026-18963**, a critical flaw in the `keycloak-services` component that allows an unauthenticated remote attacker to take over arbitrary accounts, including administrators. The vulnerability affects the password recovery process: improper state validation in the reset-credentials flow lets a crafted request bypass the normal email verification or action-token step and proceed directly to changing a user's password. Red Hat assigned the issue a **CVSS 9.1** score and classified it as **CWE-640**. Affected versions include upstream Keycloak releases earlier than **26.7.2** and Red Hat Build of Keycloak versions earlier than **26.4.15** and **26.6.6**. Red Hat and CERT-PY urged organizations to apply the available security updates, while Red Hat also published a temporary mitigation for environments that cannot patch immediately by disabling the **"Forgot password"** feature across all realms. A Nuclei template pull request was also opened to detect the issue, underscoring rapid defender interest, although no verified public exploit or confirmed in-the-wild exploitation had been reported at publication time.
Aug 31, 2026
Check Point released fixes for **CVE-2026-91843**, a critical (CVSS 9.8) stack-based buffer overflow in the login process of its Security Management and Log Server products. A remote, unauthenticated attacker can reportedly submit an excessively long username to execute arbitrary code with root privileges before authentication. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server across R81.20, R82, R82.10, R82.20, and certain older releases; **Smart-1 Cloud is not affected**. Administrators should urgently deploy Check Point’s LivePatch or applicable offline updates, verify remediation on every management and logging server, and review failed-login records for oversized-username attempts. Organizations should also restrict SmartConsole Trusted Clients until patching is validated. Check Point has not reported active exploitation or disclosed a public exploit chain; releases earlier than R81.20 are end of support and will not receive patches, requiring an upgrade or replacement strategy.
Sep 18, 2026
Red Hat released security updates for **Red Hat build of Keycloak** to fix a critical account-takeover vulnerability, tracked as `CVE-2026-18963`, in the `keycloak-services` component. The flaw affects the reset-credentials flow and allows an unauthenticated remote attacker to bypass the email verification step during password recovery, reset a victim's password, and take full control of the account. Affected versions include **26.4.x before 26.4.15** and **26.6.x before 26.6.6**, with scanners such as Nessus flagging vulnerable deployments based on reported version information. Red Hat addressed the issue in advisories **RHSA-2026:56523** and **RHSA-2026:56524**, releasing updated packages, container images, and an updated Operator for OpenShift. The advisories also bundle fixes for additional Keycloak security issues, including hidden group metadata disclosure, predictable account-linking hashes that could enable takeover through a malicious OIDC client, rotated client secret leakage via the Admin REST API, and a TOCTOU privilege-escalation bug. Red Hat advised customers to back up installations before upgrading, while **Red Hat JBoss Enterprise Application Platform Expansion Pack** was also listed as affected but did not yet have a vendor patch in the referenced reporting.
Aug 25, 2026