Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-68667— Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue

Quick assessment

Affected
continuwuity continuwuity
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

continuwuity是continuwuity开源的一个家庭服务器。 continuwuity 0.5.0之前版本存在安全漏洞，该漏洞源于未验证签名请求的来源，可能导致服务器为任意成员事件进行加密签名。

AI Predicted 7.5 Difficulty: Easy EPSS 0.59% · P46
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-68667

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue
Source: CVE Program / CVE List V5
Vulnerability Description
Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10, continuwuity prior to version 0.5.0, Grapevine prior to commit `9a50c244`, and tuwunel prior to version 1.4.8. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. Attackers can forge "leave" events for any user on the target server. This forcibly removes users (including admins and bots) from rooms. This allows denial of service and/or the removal of technical protections for a room (including policy servers, if all users on the policy server are removed). Attackers can forge "invite" events from a victim user to themselves, provided they have an account on a server where there is an account that has the power level to send invites. This allows the attacker to join private or invite-only rooms accessible by the victim, exposing confidential conversation history and room state. Attackers can forge "ban" events from a victim user to any user below the victim user's power level, provided the victim has the power level to issue bans AND the target of the ban resides on the same server as the victim. This allows the attacker to ban anyone in a room who is on the same server as the vulnerable one, however cannot exploit this to ban users on other servers or the victim themself. Conduit fixes the issue in version 0.10.10. continuwuity fixes the issue in commits `7fa4fa98` and `b2bead67`, released in 0.5.0. tuwunel fixes the issue in commit `dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3`, released in 1.4.8. Grapevine fixes the issue in commit `9a50c2448abba6e2b7d79c64243bb438b351616c`. As a workaround, block access to the `PUT /_matrix/federation/v2/invite/{roomId}/{eventId}` endpoint using your reverse proxy.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
continuwuity 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
continuwuity是continuwuity开源的一个家庭服务器。 continuwuity 0.5.0之前版本存在安全漏洞，该漏洞源于未验证签名请求的来源，可能导致服务器为任意成员事件进行加密签名。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
continuwuity continuwuity < 0.5.0 -

II. Public POCs for CVE-2025-68667

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-68667

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-68667 (2)

Vendor Advisories for CVE-2025-68667 (1)

Other References for CVE-2025-68667 (1)

IV. Related Vulnerabilities

Same product: continuwuity
Same vendor: continuwuity
Same weakness: CWE-20

V. Comments for CVE-2025-68667

No comments yet

Leave a comment