{"id":"RUSTSEC-2025-0041","revision":"b5ce75d90a1b44a080a466c5297bd31b","records":[{"revision":"b5ce75d90a1b44a080a466c5297bd31b","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2025-0041","aliases":["CVE-2025-48937","GHSA-x958-rvg6-956w"],"title":"matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator","description":"matrix-sdk-crypto versions 0.8.0 up to and including 0.11.0 does not correctly validate\nthe sender of an encrypted event. Accordingly, a malicious homeserver operator\ncan modify events served to clients, making those events appear to the recipient\nas if they were sent by another user.\n\nAlthough the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we\nconsider this a High severity security issue.","state":0,"publishedAt":"2025-06-11T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:10.9402539+00:00","affected":[{"ecosystem":"crates.io","name":"matrix-sdk-crypto","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.0"},{"kind":"fixed","version":"0.11.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/matrix-sdk-crypto","https://rustsec.org/advisories/RUSTSEC-2025-0041.html","https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2025-0041","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2025-0041","identifiers":["RUSTSEC-2025-0041","CVE-2025-48937","GHSA-x958-rvg6-956w"]},"retained":false,"historicalAffected":[]}],"coverage":[]}