CVE-2022-39254— When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder
Quick assessment
Affected
poljar matrix-nio
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Matrix是一个雄心勃勃的新生态系统，用于开放联合即时消息和 VoIP。 Matrix matrix-nio 0.19之前版本存在安全漏洞，该漏洞源于允许恶意家庭服务器在某些情况下将有效性有问题的房间密钥插入密钥存储区，从而可能有助于模拟攻击。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-39254
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder
Source: CVE Program / CVE List V5
Vulnerability Description
matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未进行实体认证的密钥交换
Source: CVE Program / CVE List V5
Vulnerability Title
Matrix 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Matrix是一个雄心勃勃的新生态系统，用于开放联合即时消息和 VoIP。 Matrix matrix-nio 0.19之前版本存在安全漏洞，该漏洞源于允许恶意家庭服务器在某些情况下将有效性有问题的房间密钥插入密钥存储区，从而可能有助于模拟攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| poljar | matrix-nio | < 0.20 | - |
|
II. Public POCs for CVE-2022-39254
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-39254
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-39254 (1)
Vendor Advisories for CVE-2022-39254 (1)
-
https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh x_refsource_CONFIRM
IV. Related Vulnerabilities
Same weakness: CWE-322
-
CVE-2026-77703
SSH Host Key Verification Bypass in HAVELSAN's Liman Render -
CVE-2026-89422
TLS 1.3 client skips server authentication when ServerHello -
CVE-2026-18654
Disabled SSH host key verification in Amazon AWS CLI EMR hel -
CVE-2026-58065
Apache Airflow Git provider: Git provider hook defaults to S -
CVE-2026-45361
Apache Airflow Google provider: SSH host key verification di
V. Comments for CVE-2022-39254
No comments yet