Read the docs
TI-2025-38692 Aliases CVE-2025-62425

Matrix Authentication Service account password can be changed using an authenticated…

Priority LOW 36CWE-620Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. A logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 allows an attacker with access to an authenticated MAS session to perform sensitive operations without entering the current password. These include changing the current password, adding or removing an e-mail address and deactivating the account. The vulnerability only affects instances which have the local password database feature enabled (passwords section in the config). Patched in matrix-authentication-service 1.4.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00459 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
element-hqmatrix-authentication-service0.20.0 – 1.4.0—No fix listedCNA
  • matrix-authentication-service Vendorelement-hq Affected 0.20.0 – 1.4.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62425

References

Other 2

  • TI-2024-35327 Synapse allows a a malformed invite to break the invitee's `/sync` CVSS 4.0HIGH 8.7
  • TI-2024-36056 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVSS 4.0HIGH 8.2
  • TI-2024-35318 Synapse allows unsupported content types to lead to memory exhaustion CVSS 4.0HIGH 8.2
  • TI-2022-07650 Remote program execution with user interaction CVSS 3.1HIGH 8.8
  • TI-2026-19372 ESS Community Helm Chart has a weak server key generation method CVSS 4.0CRITICAL 9.2
  • TI-2024-24814 Synapse denial of service through media disk space consumption CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences