CVE-2026-45056— Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
Quick assessment
Affected
matrix-org matrix-rust-sdk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
matrix-sdk-crypto 是一个实现无网络 I/O 的状态机，用于处理 Matrix 客户端的端到端加密功能。从版本 0.12.0 开始，到版本 0.17.0 之前，matrix-sdk-crypto crate 在解密包含 属性的 Olm 加密事件时，缺少对用户 ID 的校验。这一缺陷可能被利用来伪造一个加密的 to-device 事件，但前提条件是攻击者与 homeserver 操作员勾结。该问题已在 matrix-sdk-crypto 0.17.0 中修复。目前尚无已知的缓解措施。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45056
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
Source: CVE Program / CVE List V5
Vulnerability Description
matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypting an Olm-encrypted event containing the `sender_device_keys` property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator. This issue is fixed in matrix-sdk-crypto 0.17.0. There are no known workarounds for the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| matrix-org | matrix-rust-sdk | >= 0.12.0, < 0.16.1 | - |
|
II. Public POCs for CVE-2026-45056
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45056
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45056 (2)
-
-
🔗 Release matrix-sdk 0.16.1 · matrix-org/matrix-rust-sdk · GitHub x_refsource_MISC
Vendor Advisories for CVE-2026-45056 (2)
IV. Related Vulnerabilities
Same product: matrix-rust-sdk
-
CVE-2025-66622
matrix-sdk-base is vulnerable to DoS via custom m.room.join_ -
CVE-2025-59047
matrix-sdk-base has panic in the `RoomMember::normalized_pow -
CVE-2025-53549
Matrix Rust SDK allows SQL injection in the EventCache imple -
CVE-2025-48937
matrix-sdk-crypto vulnerable to sender of encrypted events b -
CVE-2024-52813
matrix-sdk-crypto missing facility to signal rotation of a v
Same vendor: matrix-org
-
CVE-2026-45057
matrix-sdk-ui: Incomplete edit validation -
CVE-2026-63097
Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State E -
CVE-2026-63096
Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Downlo -
CVE-2026-63095
Dendrite 0.13.8 Improper Authorization via POST account/3pid -
CVE-2025-66622
matrix-sdk-base is vulnerable to DoS via custom m.room.join_
Same weakness: CWE-290
-
CVE-2026-90447
Apache Shiro 5.3.5 认证路由逻辑漏洞 -
CVE-2026-63427
Lenovo Software Fix 认证绕过致特权执行漏洞 -
CVE-2026-88011
Traefik: ForwardAuth identity spoofing via dot-form header a -
CVE-2026-66674
WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Cap -
CVE-2026-88879
Traefik before v2.11.56 Identity Spoofing via Header Alias
V. Comments for CVE-2026-45056
No comments yet