CVE-2025-62425 Business logic in matrix-authentication-service
An attacker with an authenticated session can change passwords or modify account details without providing the current password in Matrix Authentication Service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62425?
CVE-2025-62425 is a high-severity vulnerability in element-hq matrix-authentication-service, published on 16 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. A logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 allows an attacker with access to an authenticated MAS session to perform sensitive operations without entering the current password. These include changing the current password, adding or removing an e-mail address and deactivating the account. The vulnerability only affects instances which have the local password database feature enabled (passwords section in the config). Patched in matrix-authentication-service 1.4.1.
Weakness: CWE-620
Which versions are affected by CVE-2025-62425?
How do I fix CVE-2025-62425?
No fix has been published for CVE-2025-62425 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-62425 being exploited?
There is no known exploitation of CVE-2025-62425 in the wild and no public exploit code.
Sources
Also known as GHSA-6wfp-jq3r-j9xh.