{"id":"CVE-2025-48937","aliases":["RUSTSEC-2025-0041","GHSA-x958-rvg6-956w"],"title":"matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator","summary":"matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","vendor":"matrix-sdk-crypto","product":"matrix-sdk-crypto","ecosystem":"rust","affected":["matrix-sdk-crypto >= 0.8.0, < 0.11.1"],"patched":["matrix-sdk-crypto 0.11.1"],"published":"2025-06-11","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:10.940253855Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2025-0041","references":[{"url":"https://crates.io/crates/matrix-sdk-crypto"},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0041.html"},{"url":"https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55"}],"tags":["osv","rust"],"epss":0.00369,"epssPercentile":0.28799,"ingestedAt":"2026-10-13T11:45:30.177Z","slug":"CVE-2025-48937","body":"## Overview\n\nmatrix-sdk-crypto versions 0.8.0 up to and including 0.11.0 does not correctly validate\nthe sender of an encrypted event. Accordingly, a malicious homeserver operator\ncan modify events served to clients, making those events appear to the recipient\nas if they were sent by another user.\n\nAlthough the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we\nconsider this a High severity security issue.\n\n## Affected packages\n\n- `matrix-sdk-crypto >= 0.8.0, < 0.11.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-sdk-crypto 0.11.1`","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}