CVE-2019-11842

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-09 · updated 2026-06-17
Weakness: CWE-338

Description

An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.

Affected products

matrix-org sydent: before 1.0.3 — fixed in 1.0.3
matrix-org synapse: before 0.99.3.1 — fixed in 0.99.3.1

How to fix

Upgrade to a fixed version: matrix-org sydent 1.0.3; matrix-org synapse 0.99.3.1. Check the vendor advisory for mitigations.

References

https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a/
https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a/

Get alerted when CVE-2019-11842 or the next vulnerability affects your stack