matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
Priority LOW 23CWE-290Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix Fixed matrix-rust-sdk (matrix-org): 0.11.1matrix-sdk-crypto (crates.io): 0.11.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | matrix-rust-sdk | 0.8.0 to before 0.11.1 | 0.11.1 | Patch available | CNA |
| — | matrix-sdk-crypto (crates.io) | 0.8.0 to before 0.11.1 | 0.11.1 | Patch available | GHSA-x958-rvg6-956w |
- matrix-rust-sdk Vendormatrix-org Affected 0.8.0 to before 0.11.1 Fixed in 0.11.1 Patch available CNA
- matrix-sdk-crypto (crates.io) Vendor— Affected 0.8.0 to before 0.11.1 Fixed in 0.11.1 Patch available GHSA-x958-rvg6-956w
Remediation
- Fix · CNA matrix-rust-sdk (matrix-org) Fixed in 0.11.1
- Fix · GHSA-x958-rvg6-956w matrix-sdk-crypto (crates.io) Fixed in 0.11.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48937
- 2026-10-03 Alias added: GHSA-x958-rvg6-956w
References
Other 6
- https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w
- https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55
- https://github.com/matrix-org/matrix-rust-sdk/commit/56980745b4f27f7dc72ac296e6aa003e5d92a75b
- https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2
- https://github.com/matrix-org/matrix-rust-sdk
- https://rustsec.org/advisories/RUSTSEC-2025-0041.html
More matrix-org vulnerabilities
- TI-2023-20035 Sydent does not verify email server certificates CVSS 3.1CRITICAL 9.3
- TI-2026-45046 Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint CVSS 4.0MEDIUM 6.9
- TI-2026-45045 Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint CVSS 4.0HIGH 7.1
- TI-2026-45047 Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure CVSS 4.0MEDIUM 5.3
- TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
- TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-48937 · CVE Program
- CVE-2025-48937 · NVD
- FIRST EPSS
- GHSA-x958-rvg6-956w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences