---
id: CVE-2022-39254
aliases:
  - GHSA-w4pr-4vjg-hffh
  - PYSEC-2026-842
title: >-
  When matrix-nio receives forwarded room keys, the receiver doesn't check if it
  requested the key from the forwarder
summary: >-
  When matrix-nio receives forwarded room keys, the receiver doesn't check if it
  requested the key from the forwarder
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N'
vendor: matrix-nio
product: matrix-nio
ecosystem: pip
affected:
  - matrix-nio < 0.20
patched:
  - matrix-nio 0.20
published: '2022-09-30'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-w4pr-4vjg-hffh'
references:
  - url: >-
      https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-39254'
  - url: >-
      https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0
  - url: 'https://github.com/poljar/matrix-nio'
tags:
  - osv
  - pip
epss: 0.00597
epssPercentile: 0.46231
ingestedAt: '2026-07-08T18:25:53.545Z'
---

## Overview

When matrix-nio before 0.20 requests a room key from our devices, it correctly accepts key forwards only if they are a response to a previous request. However, it doesn't check that the device that responded matches the device the key was requested from.

This allows a malicious homeserver to insert room keys of questionable validity into the key store in some situations, potentially assisting in an impersonation attack.

### For more information
If you have any questions or comments about this advisory, e-mail us at [poljar@termina.org.uk](mailto:poljar@termina.org.uk).

## Affected packages

- `matrix-nio < 0.20`

## Remediation

Upgrade to a patched release:

- `matrix-nio 0.20`