CVE-2025-48937 matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
A malicious homeserver can spoof the sender of encrypted events, allowing impersonation of other users in Matrix clients using the vulnerable library.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48937?
CVE-2025-48937 is a medium-severity authentication bypass vulnerability in matrix-org matrix-rust-sdk, published on 10 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0.
Weakness: CWE-290
Which versions are affected by CVE-2025-48937?
3 open source packages ship an affected version, including matrix-sdk-crypto.
| Package | Affected | Fixed in |
|---|---|---|
matrix-sdk-crypto crates.io | From 0.8.0 | 0.11.1 |
matrix-sdk-crypto crates.io | From 0.8.0 | 0.11.1 |
matrix-sdk-crypto crates.io | From 0.8.0 | 0.11.1 |
Linux distribution packages (1)
fractal openSUSE:Tumbleweed | All versions | 11.2-1.1 |
How do I fix CVE-2025-48937?
Upgrade matrix-sdk-crypto to 0.11.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-48937 being exploited?
There is no known exploitation of CVE-2025-48937 in the wild and no public exploit code.
Sources
Also known as GHSA-x958-rvg6-956w, RUSTSEC-2025-0041, openSUSE-SU-2025:15218-1.