Read the docs
TI-2022-18625 Aliases CVE-2022-39249GHSA-6263-x97c-c4gg

Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions

Priority MEDIUM 41CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately, for example, by showing a warning for such messages. This attack requires coordination between a malicious homeserver and an attacker, and those who trust your homeservers do not need a workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01276 70th percentileScored 2026-11-07
Fix Partial matrix-js-sdk (matrix-org): 19.7.0matrix-js-sdk (npm): 19.7.0Red Hat: 6 advisoriesRed Hat: 8 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
matrix-orgmatrix-js-sdkbefore 19.7.019.7.0Patch availableCNA
—matrix-js-sdk (npm)before 19.7.019.7.0Patch availableGHSA-6263-x97c-c4gg
  • matrix-js-sdk Vendormatrix-org Affected before 19.7.0 Fixed in 19.7.0 Patch available CNA
  • matrix-js-sdk (npm) Vendor— Affected before 19.7.0 Fixed in 19.7.0 Patch available GHSA-6263-x97c-c4gg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:*before 19.7.0Vulnerablematrix-org
  • cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:* Versions before 19.7.0 Vulnerable ·matrix-org

Remediation

  • Fix · CNA matrix-js-sdk (matrix-org) Fixed in 19.7.0
  • Fix · GHSA-6263-x97c-c4gg matrix-js-sdk (npm) Fixed in 19.7.0 Advisory →

Red Hat 6 advisories

  • RHSA-2022:7190 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-102.4.0-1.el8_6
  • RHSA-2022:7184 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux Client (v. 7) thunderbird-102.4.0-1.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-102.4.0-1.el7_9
    • Red Hat Enterprise Linux Workstation (v. 7) thunderbird-102.4.0-1.el7_9
  • RHSA-2022:7181 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) thunderbird-102.4.0-1.el8_4
Show 3 more Red Hat advisories
  • RHSA-2022:7183 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird-102.4.0-1.el8_1
  • RHSA-2022:7182 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) thunderbird-102.4.0-1.el8_2
  • RHSA-2022:7178 Released 2022-10-25 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-102.4.0-1.el9_0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    matrix-org matrix-js-sdk — GLSA-202210-35

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusionPriority MEDIUM 46
    • TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationPriority MEDIUM 46
    • TI-2022-18613 Matrix Javascript SDK improper beacon events can cause availability issuesPriority LOW 27
    Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:7190
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:7178
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2022:7183
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2022:7182
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:7181
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2022:7184
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2022:7184
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2022:7184

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39249
  2. 2026-10-03 Alias added: GHSA-6263-x97c-c4gg

References

Patch 2

Advisory 5

Other 1

  • TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion CVSS 3.1HIGH 8.6
  • TI-2022-18626 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification CVSS 3.1HIGH 8.6
  • TI-2021-20136 The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer… CVSS 3.1CRITICAL 9.8
  • TI-2023-12971 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
  • TI-2022-16482 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
  • TI-2021-17748 A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix… CVSS 3.1MEDIUM 5.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences