GHSA-wfq4-36m3-9g42

Source

https://github.com/advisories/GHSA-wfq4-36m3-9g42

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-wfq4-36m3-9g42/GHSA-wfq4-36m3-9g42.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wfq4-36m3-9g42

Aliases

Published

2026-06-04T14:47:05Z

Modified

2026-06-04T15:00:08Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

Details

Impact

The matrix-sdk-crypto crate before 0.16.1 is missing a check for the sender's user ID when decrypting an Olm-encrypted to-device message containing the sender_device_keys property.

This could be exploited to spoof the sender of an encrypted to-device message, but only if the attacker colludes with (or is) the homeserver operator.

Patches

This issue is fixed in matrix-sdk-crypto 0.16.1.

Workarounds

There are no known workarounds for the issue.

References

This issue was fixed in https://github.com/matrix-org/matrix-rust-sdk/pull/6553.

For more information

If you have any questions or comments about this advisory, please email us at security at matrix.org.

Database specific

{
    "cwe_ids":  [
        "CWE-290"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-04T14:47:05Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

crates.io / matrix-sdk-crypto

Package

Name: matrix-sdk-crypto; View open source insights on deps.dev
Purl: pkg:cargo/matrix-sdk-crypto

Affected ranges

Type: SEMVER
Events: Introduced

0.12.0

Fixed

0.16.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-wfq4-36m3-9g42/GHSA-wfq4-36m3-9g42.json"