{"id":"GHSA-x958-rvg6-956w","revision":"4df3193fa14943a5ad72721b72719500","records":[{"revision":"4df3193fa14943a5ad72721b72719500","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-x958-rvg6-956w","aliases":["CVE-2025-48937","RUSTSEC-2025-0041"],"title":"matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator","description":"### Summary\n\nmatrix-sdk-crypto since version 0.8.0 up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user.\n\nAlthough the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we consider this a High Severity security issue.\n\n### Details\n\nThe Matrix specification [requires](https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2) that clients ensure that \"the event’s `sender`, `room_id`, and the recorded `session_id` match a trusted session\". The vulnerable matrix-sdk-crypto versions check that the `room_id` matches that of the session denoted by `session_id`, but do not check the `sender`.\n\n### Patches\n\nThe issue is resolved by [13c1d20](https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55), included in versions 0.11.1 and 0.12.0 of matrix-sdk-crypto.\n\n### Workarounds\n\nSince a successful attack requires administrator access to the homeserver, users who trust the administrators of their local homeserver are not affected.\n\n### References\n\n * https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2","state":0,"publishedAt":"2025-06-10T20:15:37+00:00","modifiedAt":"2025-06-12T21:23:37+00:00","affected":[{"ecosystem":"crates.io","name":"matrix-sdk-crypto","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.0"},{"kind":"fixed","version":"0.11.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w","https://nvd.nist.gov/vuln/detail/CVE-2025-48937","https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55","https://github.com/matrix-org/matrix-rust-sdk/commit/56980745b4f27f7dc72ac296e6aa003e5d92a75b","https://github.com/matrix-org/matrix-rust-sdk","https://rustsec.org/advisories/RUSTSEC-2025-0041.html","https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2"],"sourceUrl":"https://github.com/advisories/GHSA-x958-rvg6-956w","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-x958-rvg6-956w","identifiers":["GHSA-x958-rvg6-956w","CVE-2025-48937","RUSTSEC-2025-0041"]},"retained":false,"historicalAffected":[]}],"coverage":[]}