CVE-2022-39254 json
When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder
published 2022-09-29 4 y ago modified 2026-07-07 4 mo ago also GHSA-w4pr-4vjg-hffh , PYSEC-2026-842 , EUVD-2022-6957
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.
Patch / fix
- pypi matrix-nio 0.20
- matrix-nio_project matrix-nio 0.20
- python-matrix-nio Debian 14, Debian 13, Debian 12 0.20.0-1
debian advisories DEBIAN-CVE-2022-39254
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
| OSV | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | matrix-nio | <0.20 |
0.20 |
Affected products
- poljar matrix-nio
Classification
References
-
github.com
/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0
web, patch, third-party-advisory
-
github.com
/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-39254
advisory
-
github.com
/poljar/matrix-nio
package
-
pypi.org
/project/matrix-nio
package
-
github.com
/advisories/GHSA-w4pr-4vjg-hffh
advisory
Sources
- CVE List CVE-2022-39254
- GitHub Advisory GHSA-w4pr-4vjg-hffh
- NVD CVE-2022-39254
- OSV PYSEC-2026-842
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.