CVE-2025-48937Medium· 4.9▾ Sunlitmatrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
matrix-sdk-crypto versions 0.8.0 up to and including 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user.
Although the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we consider this a High severity security issue.
matrix-sdk-crypto >= 0.8.0, < 0.11.1Upgrade to a patched release:
matrix-sdk-crypto 0.11.1Connected by shared product, vendor, weakness, or advisory.
CVE-2024-52813NoneMissing facility to signal rotation of a verified cryptographic identity
CVE-2024-40648None`UserIdentity::is_verified` not checking verification status of own user identity while performing the check
RUSTSEC-2026-0318NoneSending custom to-device messages may panics