{"id":"RUSTSEC-2026-0159","revision":"c6b4ba88c0f1473a8231743ed3eb5d02","records":[{"revision":"c6b4ba88c0f1473a8231743ed3eb5d02","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0159","aliases":["CVE-2026-45056","GHSA-wfq4-36m3-9g42"],"title":"Sender-binding gaps in to-device messages","description":"The matrix-sdk-crypto crate before 0.16.1 is missing a check for the sender's\nuser ID when decrypting an Olm-encrypted to-device message containing the\nsender_device_keys property.\n\nThis could be exploited to spoof the sender of an encrypted to-device message,\nbut only if the attacker colludes with (or is) the homeserver operator.","state":0,"publishedAt":"2026-06-03T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:09.2401035+00:00","affected":[{"ecosystem":"crates.io","name":"matrix-sdk-crypto","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.12.0"},{"kind":"fixed","version":"0.16.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/matrix-sdk-crypto","https://rustsec.org/advisories/RUSTSEC-2026-0159.html","https://github.com/matrix-org/matrix-rust-sdk/pull/6553"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0159","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0159","identifiers":["RUSTSEC-2026-0159","CVE-2026-45056","GHSA-wfq4-36m3-9g42"]},"retained":false,"historicalAffected":[]}],"coverage":[]}