---
id: CVE-2024-40648
aliases:
  - RUSTSEC-2024-0356
  - GHSA-4qg4-cvh2-crgg
title: >-
  `UserIdentity::is_verified` not checking verification status of own user
  identity while performing the check
summary: >-
  `UserIdentity::is_verified` not checking verification status of own user
  identity while performing the check
severity: none
vendor: matrix-sdk-crypto
product: matrix-sdk-crypto
ecosystem: rust
affected:
  - 'matrix-sdk-crypto >= 0.0.0-0, < 0.7.2'
patched:
  - matrix-sdk-crypto 0.7.2
published: '2024-07-18'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:12.405685687Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2024-0356'
references:
  - url: 'https://crates.io/crates/matrix-sdk-crypto'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2024-0356.html'
  - url: >-
      https://github.com/matrix-org/matrix-rust-sdk/commit/76a7052149bb8f722df12da915b3a06d19a6695a
tags:
  - osv
  - rust
epss: 0.0028
epssPercentile: 0.18834
ingestedAt: '2026-10-13T11:45:30.169Z'
---

## Overview

The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before
version 0.7.2 doesn't take into account the verification status of the user's
own identity while performing the check and may as a result return a value
contrary to what is implied by its name and documentation.

## Impact

If the method is used to decide whether to perform sensitive operations towards
a user identity, a malicious homeserver could manipulate the outcome in order to
make the identity appear trusted. This is not a typical usage of the method,
which lowers the impact. The method itself is not used inside the
matrix-sdk-crypto crate.

## Affected packages

- `matrix-sdk-crypto >= 0.0.0-0, < 0.7.2`

## Remediation

Upgrade to a patched release:

- `matrix-sdk-crypto 0.7.2`