CVE-2022-39249 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions

High 7.5 Published 28 Sep 2022 Updated 23 Apr 2025

Attackers can impersonate users by exploiting permissive key forwarding, requiring a malicious homeserver and attacker coordination to bypass identity verification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-39249?

CVE-2022-39249 is a high-severity authentication bypass vulnerability in matrix-org matrix-js-sdk, published on 28 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately, for example, by showing a warning for such messages. This attack requires coordination between a malicious homeserver and an attacker, and those who trust your homeservers do not need a workaround.

Weakness: CWE-322, CWE-287

Which versions are affected by CVE-2022-39249?

2 open source packages ship an affected version, including matrix-js-sdk. It affects 1 product.

Package	Affected	Fixed in
`matrix-js-sdk` npm	All versions	`19.7.0`
`matrix-js-sdk` npm	All versions	`19.7.0`

Products include Matrix Javascript Sdk.

How do I fix CVE-2022-39249?

Upgrade matrix-js-sdk to 19.7.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-39249 being exploited?

There is no known exploitation of CVE-2022-39249 in the wild and no public exploit code.

Sources

Also known as CLEANSTART-2024-QT51844, DEBIAN-CVE-2022-39249, GHSA-6263-x97c-c4gg, UBUNTU-CVE-2022-39249.