{"id":"CVE-2022-39254","aliases":["GHSA-w4pr-4vjg-hffh","PYSEC-2026-842"],"title":"When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder","summary":"When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","vendor":"matrix-nio","product":"matrix-nio","ecosystem":"pip","affected":["matrix-nio < 0.20"],"patched":["matrix-nio 0.20"],"published":"2022-09-30","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-w4pr-4vjg-hffh","references":[{"url":"https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39254"},{"url":"https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0"},{"url":"https://github.com/poljar/matrix-nio"}],"tags":["osv","pip"],"epss":0.00597,"epssPercentile":0.47258,"ingestedAt":"2026-07-08T18:25:53.545Z","slug":"CVE-2022-39254","body":"## Overview\n\nWhen matrix-nio before 0.20 requests a room key from our devices, it correctly accepts key forwards only if they are a response to a previous request. However, it doesn't check that the device that responded matches the device the key was requested from.\n\nThis allows a malicious homeserver to insert room keys of questionable validity into the key store in some situations, potentially assisting in an impersonation attack.\n\n### For more information\nIf you have any questions or comments about this advisory, e-mail us at [poljar@termina.org.uk](mailto:poljar@termina.org.uk).\n\n## Affected packages\n\n- `matrix-nio < 0.20`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-nio 0.20`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}