{"id":"CVE-2022-39254","aliases":["GHSA-w4pr-4vjg-hffh","PYSEC-2026-842"],"url":"https://o3.security/vulnerability/CVE-2022-39254","summary":"When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder","details":"When matrix-nio before 0.20 requests a room key from our devices, it correctly accepts key forwards only if they are a response to a previous request. However, it doesn't check that the device that responded matches the device the key was requested from.\n\nThis allows a malicious homeserver to insert room keys of questionable validity into the key store in some situations, potentially assisting in an impersonation attack.\n\n### For more information\nIf you have any questions or comments about this advisory, e-mail us at [poljar@termina.org.uk](mailto:poljar@termina.org.uk).","published":"2022-09-29T14:35:10Z","modified":"2026-10-28T02:30:57.554619333Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"},"epss":{"score":0.00572,"percentile":0.44665,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"matrix-nio","fixedVersion":"0.20"}],"fix":{"url":"https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0","label":"poljar/matrix-nio@b1cbf23"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39254.json"},{"type":"ADVISORY","url":"https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39254"},{"type":"FIX","url":"https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0"},{"type":"PACKAGE","url":"https://github.com/poljar/matrix-nio"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:57.554619333Z"}}