TI-2022-18626 Aliases CVE-2022-39250 GHSA-5w8r-8pgj-5jmf

Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification

MEDIUM 46CWE-287Published 2022-09-29 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01186 68th percentileScored 2026-11-07

Fix Partial matrix-js-sdk (matrix-org): 19.7.0matrix-js-sdk (npm): 19.7.0Red Hat: 6 advisoriesRed Hat: 8 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
matrix-org	matrix-js-sdk	before 19.7.0	19.7.0	Patch available	CNA
—	matrix-js-sdk (npm)	before 19.7.0	19.7.0	Patch available	GHSA-5w8r-8pgj-5jmf

matrix-js-sdk Vendormatrix-org Affected before 19.7.0 Fixed in 19.7.0 Patch available CNA
matrix-js-sdk (npm) Vendor— Affected before 19.7.0 Fixed in 19.7.0 Patch available GHSA-5w8r-8pgj-5jmf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:matrix:javascript_sdk::::::node.js::*	before 19.7.0	Vulnerable	matrix-org

cpe:2.3:a:matrix:javascript_sdk:*:*:*:*:*:node.js:*:* Versions before 19.7.0 Vulnerable ·matrix-org

Remediation

Fix · CNA matrix-js-sdk (matrix-org) Fixed in 19.7.0
Fix · GHSA-5w8r-8pgj-5jmf matrix-js-sdk (npm) Fixed in 19.7.0 Advisory →

Red Hat 6 advisories

RHSA-2022:7190 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux AppStream (v. 8) thunderbird-102.4.0-1.el8_6
RHSA-2022:7184 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux Client (v. 7) thunderbird-102.4.0-1.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-102.4.0-1.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-102.4.0-1.el7_9
RHSA-2022:7181 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v.8.4) thunderbird-102.4.0-1.el8_4

Show 3 more Red Hat advisories

RHSA-2022:7183 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird-102.4.0-1.el8_1
RHSA-2022:7182 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) thunderbird-102.4.0-1.el8_2
RHSA-2022:7178 Released 2022-10-25 · Red Hat rating Important
thunderbird security update
- Red Hat Enterprise Linux AppStream (v. 9) thunderbird-102.4.0-1.el9_0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2022-09-28
matrix-org matrix-js-sdk — GLSA-202210-35
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusionPriority MEDIUM 46
- TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsPriority MEDIUM 41
- TI-2022-18613 Matrix Javascript SDK improper beacon events can cause availability issuesPriority LOW 27
Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2022:7190
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2022:7178
Red Hat Enterprise Linux AppStream E4S (v. 8.1)	Fixed	RHSA-2022:7183
Red Hat Enterprise Linux AppStream EUS (v. 8.2)	Fixed	RHSA-2022:7182
Red Hat Enterprise Linux AppStream EUS (v.8.4)	Fixed	RHSA-2022:7181
Red Hat Enterprise Linux Client (v. 7)	Fixed	RHSA-2022:7184
Red Hat Enterprise Linux Server Optional (v. 7)	Fixed	RHSA-2022:7184
Red Hat Enterprise Linux Workstation (v. 7)	Fixed	RHSA-2022:7184

Timeline

2026-10-02 Threatist record created from CVE-2022-39250
2026-10-03 Alias added: GHSA-5w8r-8pgj-5jmf

References

Patch 1

https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76

Advisory 5

Other 1

https://github.com/matrix-org/matrix-js-sdk

TI-2022-18627 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion CVSS 3.1HIGH 8.6
TI-2021-20136 The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer… CVSS 3.1CRITICAL 9.8
TI-2023-12971 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
TI-2022-16482 Prototype pollution in matrix-js-sdk CVSS 3.1HIGH 8.2
TI-2022-18625 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions CVSS 3.1HIGH 7.5
TI-2021-17748 A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix… CVSS 3.1MEDIUM 5.9

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences