CVE-2026-45056

Sender-binding gaps in to-device messages

Published: 6/4/2026Modified: 6/4/2026
Also known as:GHSA-wfq4-36m3-9g42RUSTSEC-2026-0159

Description

The matrix-sdk-crypto crate before 0.16.1 is missing a check for the sender's user ID when decrypting an Olm-encrypted to-device message containing the sender_device_keys property. This could be exploited to spoof the sender of an encrypted to-device message, but only if the attacker colludes with (or is) the homeserver operator.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 4.0—CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References (6)