PkgSeer

Vulnerability RUSTSEC-2026-0159

Unknown

4 months ago

Sender-binding gaps in to-device messages

0.12.0 - 0.16.0

Summary

Sender-binding gaps in to-device messages

Details

The matrix-sdk-crypto crate before 0.16.1 is missing a check for the sender's user ID when decrypting an Olm-encrypted to-device message containing the sender_device_keys property.

This could be exploited to spoof the sender of an encrypted to-device message, but only if the attacker colludes with (or is) the homeserver operator.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Sending custom to-device messages may panics

0.1.0 - 0.18.0 RUSTSEC-2026-0318

Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

0.12.0 - 0.16.0 GHSA-wfq4-36m3-9g42

matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator

0.8.0 - 0.11.0 RUSTSEC-2025-0041

matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

0.8.0 - 0.11.0 GHSA-x958-rvg6-956w

matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity

0.1.0 - 0.7.2 GHSA-r5vf-wf4h-82gg

View all vulnerabilities for these packages

Impacted packages

matrix-sdk-crypto

Timeline

Published

4 months ago

Fixed (0.16.1)

4 months ago

Last Modified

3 months ago