CVE-2026-45056

Received Received - Intake

Forgery of Encrypted To-Device Events in matrix-sdk-crypto

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypting an Olm-encrypted event containing the `sender_device_keys` property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator. This issue is fixed in matrix-sdk-crypto 0.17.0. There are no known workarounds for the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-45056

Affected Vendors & Products

Vendor	Product	Version / Range
matrix	matrix-sdk-crypto	to 0.17.0 (exc)
matrix	matrix-sdk-crypto	0.17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

The vulnerability in matrix-sdk-crypto (versions 0.12.0 to 0.17.0) involves a missing check for the user ID when decrypting an Olm-encrypted event containing the sender_device_keys property. This allows an attacker to forge an encrypted to-device event, but only if they collude with the homeserver operator.

Detection Guidance

This vulnerability requires collusion with a homeserver operator and cannot be detected through standard network or system commands alone. The issue is specific to the matrix-sdk-crypto library versions 0.12.0 to 0.16.x. Check your installed version with 'cargo list matrix-sdk-crypto' or similar package manager commands. If using version 0.17.0 or later, the vulnerability is resolved.

Impact Analysis

This vulnerability could allow an attacker to forge encrypted messages, potentially leading to unauthorized access or manipulation of communications. However, exploitation requires collusion with the homeserver operator, reducing the risk for most users.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing a forged encrypted event if an attacker colludes with a homeserver operator. This may lead to unauthorized access or manipulation of sensitive data, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Update matrix-sdk-crypto to version 0.17.0 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-45056. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70