---
id: CVE-2025-48937
aliases:
  - RUSTSEC-2025-0041
  - GHSA-x958-rvg6-956w
title: >-
  matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver
  administrator
summary: >-
  matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver
  administrator
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N'
vendor: matrix-sdk-crypto
product: matrix-sdk-crypto
ecosystem: rust
affected:
  - 'matrix-sdk-crypto >= 0.8.0, < 0.11.1'
patched:
  - matrix-sdk-crypto 0.11.1
published: '2025-06-11'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:10.940253855Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2025-0041'
references:
  - url: 'https://crates.io/crates/matrix-sdk-crypto'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2025-0041.html'
  - url: >-
      https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55
tags:
  - osv
  - rust
epss: 0.00369
epssPercentile: 0.28799
ingestedAt: '2026-10-13T11:45:30.177Z'
---

## Overview

matrix-sdk-crypto versions 0.8.0 up to and including 0.11.0 does not correctly validate
the sender of an encrypted event. Accordingly, a malicious homeserver operator
can modify events served to clients, making those events appear to the recipient
as if they were sent by another user.

Although the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we
consider this a High severity security issue.

## Affected packages

- `matrix-sdk-crypto >= 0.8.0, < 0.11.1`

## Remediation

Upgrade to a patched release:

- `matrix-sdk-crypto 0.11.1`