CVE-2025-48937

MEDIUM4.9EPSS 0.27%

matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator

Published: 6/10/2025Modified: 6/12/2025
Also known as:GHSA-x958-rvg6-956wRUSTSEC-2025-0041

Description

matrix-sdk-crypto versions 0.8.0 up to and including 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. Although the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we consider this a High severity security issue.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM4.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

References (8)