CVE-2025-48937: Matrix sdk crypto Matrix-sdk-crypto Vulnerable To Sender Of Vulnerability

MODERATE
Advisory Identifier: GHSA-x958-rvg6-956w
Share
CVSS 4.9
CWE-290
Published
Advisory Summary

CVE-2025-48937 is a MODERATE (CVSS 4.9) matrix-sdk-crypto vulnerable to sender of vulnerability (CWE-290: Authentication Bypass by Spoofing) affecting Matrix sdk crypto libraries in the crates.io ecosystem. The issue involves matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator. Remediation is available by upgrading affected packages to version 0.11.1.

CVE-2025-48937 at a Glance

CVE Identifier CVE-2025-48937
GHSA Identifier GHSA-x958-rvg6-956w
Severity MODERATE
CVSS v3.1 Base Score 4.9
CWE Classification CWE-290: Authentication Bypass by Spoofing
Affected Product Matrix sdk crypto
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 4.9

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required High (PR:H)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2025-48937

To remediate this vulnerability, upgrade all affected Matrix sdk crypto dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

matrix-sdk-crypto fixed: 0.11.1 
Upgrade matrix-sdk-crypto to 0.11.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for matrix-sdk-crypto

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-48937, inspect your project dependencies for Matrix sdk crypto:

inspect dependencies for matrix-sdk-crypto

Analyze the terminal output to locate any version of Matrix sdk crypto in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.11.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-290: Authentication Bypass by Spoofing, where this attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. In Matrix sdk crypto, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary matrix-sdk-crypto since version 0.8.0 up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. Although the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we consider this a High Severity security issue. ### Details The Matrix specification [requires](https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2) that clients ensure that "the event’s `sender`, `room_id`, and the recorded `session_id` match a trusted session". The vulnerable matrix-sdk-crypto versions check that the `room_id` matches that of the session denoted by `session_id`, but do not check the `sender`. ### Patches The issue is resolved by [13c1d20](https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55), included in versions 0.11.1 and 0.12.0 of matrix-sdk-crypto. ### Workarounds Since a successful attack requires administrator access to the homeserver, users who trust the administrators of their local homeserver are not affected. ### References * https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2

CVE-2025-48937 Affected Matrix sdk crypto Versions

1 component(s)
Fixed Versions:
0.11.1
Product / Package Ecosystem Affected Versions Fixed Version
matrix-sdk-crypto
 crates.io
≥ 0.8.0
< 0.11.1
0.11.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w
NVD — CVE-2025-48937 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-48937
Security Fix Commit FIX COMMIT
https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55
Security Fix Commit FIX COMMIT
https://github.com/matrix-org/matrix-rust-sdk/commit/56980745b4f27f7dc72ac296e6aa003e5d92a75b
Matrix sdk crypto Source Repository REPOSITORY
https://github.com/matrix-org/matrix-rust-sdk
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2025-0041.html
spec.matrix.org/v1.14/client-server... WEB
https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2

Frequently Asked Questions

What is CVE-2025-48937?
CVE-2025-48937 is a security vulnerability in Matrix sdk crypto involving matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator under CWE-290: Authentication Bypass by Spoofing.
Which Matrix sdk crypto versions are affected?
Affected versions include releases prior to 0.11.1 across affected packages: matrix-sdk-crypto.
What version fixes CVE-2025-48937?
Upgrading to 0.11.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is matrix-sdk-crypto affected?
Yes, matrix-sdk-crypto is affected in releases prior to 0.11.1. Upgrade your dependency to 0.11.1 or later.
What is the CVSS score of CVE-2025-48937?
CVE-2025-48937 has a CVSS v3.1 base score of 4.9 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.
What CWE is associated with CVE-2025-48937?
CVE-2025-48937 is classified under CWE-290: Authentication Bypass by Spoofing (This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.).
How can I check crates.io dependencies for CVE-2025-48937?
Run the dependency tree command: 'inspect dependencies for matrix-sdk-crypto'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x958-rvg6-956w",
  "modified" : "2025-06-12T21:23:37Z",
  "published" : "2025-06-10T20:15:37Z",
  "aliases" : [ "CVE-2025-48937" ],
  "summary" : "matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator",
  "details" : "### Summary\n\nmatrix-sdk-crypto since version 0.8.0 up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user.\n\nAlthough the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we consider this a High Severity security issue.\n\n### Details\n\nThe Matrix specification [requires](https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2) that clients ensure that \"the event’s `sender`, `room_id`, and the recorded `session_id` match a trusted session\". The vulnerable matrix-sdk-crypto versions check that the `room_id` matches that of the session denoted by `session_id`, but do not check the `sender`.\n\n### Patches\n\nThe issue is resolved by [13c1d20](https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55), included in versions 0.11.1 and 0.12.0 of matrix-sdk-crypto.\n\n### Workarounds\n\nSince a successful attack requires administrator access to the homeserver, users who trust the administrators of their local homeserver are not affected.\n\n### References\n\n * https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "matrix-sdk-crypto"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.8.0"
      }, {
        "fixed" : "0.11.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-48937"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/matrix-org/matrix-rust-sdk/commit/56980745b4f27f7dc72ac296e6aa003e5d92a75b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/matrix-org/matrix-rust-sdk"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2025-0041.html"
  }, {
    "type" : "WEB",
    "url" : "https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-290" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-06-10T20:15:37Z",
    "nvd_published_at" : "2025-06-10T16:15:41Z"
  }
}