What’s Vulnerable › Vulnerabilities

CVE-2021-29432: Malicious users could control the content of invitation emails

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-15 · updated 2026-06-17
• Weakness: CWE-20

Description

Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.

Affected products

• matrix-org sydent: before 2.3.0 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: matrix-org sydent 2.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42
• https://github.com/matrix-org/sydent/releases/tag/v2.3.0
• https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx
• https://pypi.org/project/matrix-sydent/
• https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42
• https://github.com/matrix-org/sydent/releases/tag/v2.3.0
• https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx
• https://pypi.org/project/matrix-sydent/

Get alerted when CVE-2021-29432 or the next vulnerability affects your stack