What’s Vulnerable › Vulnerabilities

CVE-2022-39254: When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-29 · updated 2026-06-17
• Weakness: CWE-287

Description

matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.

Affected products

• poljar matrix-nio: before 0.20 — fixed in 0.20

How to fix

Upgrade to a fixed version: poljar matrix-nio 0.20. Check the vendor advisory for mitigations.

References

• https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0
• https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh
• https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0
• https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh

Get alerted when CVE-2022-39254 or the next vulnerability affects your stack