CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2025-48937 – matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
https://notcve.org/view.php?id=CVE-2025-48937
10 Jun 2025 — matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0. • https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52813 – matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity
https://notcve.org/view.php?id=CVE-2024-52813
07 Jan 2025 — matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed. • https://github.com/matrix-org/matrix-rust-sdk/pull/3795 • CWE-223: Omission of Security-relevant Information •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-40648 – `UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk
https://notcve.org/view.php?id=CVE-2024-40648
18 Jul 2024 — matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the ... • https://github.com/matrix-org/matrix-rust-sdk/commit/76a7052149bb8f722df12da915b3a06d19a6695a • CWE-287: Improper Authentication •