---
id: 3806
title: "Predicting MongoDB ObjectId() continuously in Rocket.Chat"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/predicting-mongodb-objectid-rocket-chat"
published_at: "2026-07-06 00:00"
tags: ["ai-security", "vulnerability-research", "rocket-chat", "web-security", "mongodb", "objectid", "predictable-ids", "unauthenticated-access"]
phying_url: "https://phying.com/item/3806"
lang: en
---

# Predicting MongoDB ObjectId() continuously in Rocket.Chat

## Summary

Aikido shows how MongoDB ObjectId predictability let an unauthenticated attacker enumerate every uploaded file in Rocket.Chat by continuously predicting new IDs; fixed in 8.5.1 and earlier branches.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-07-06 00:00
- **Original:** https://www.aikido.dev/blog/predicting-mongodb-objectid-rocket-chat
- **Phying News:** https://phying.com/item/3806