# CVE-2021-40823: Matrix matrix-js-sdk E2EE room key disclosure to homeservers

Source: https://junglewise.ai/threats/cve-2021-40823-matrix-matrix-js-sdk-e2ee-room-key-disclosure-to-homeservers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-09-14. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2021-40823 · Severity: low · CVSS 3.1 · Published 2021-09-14

A security flaw in the Matrix JavaScript SDK, used by popular messaging apps like Element and Cinny, could allow a malicious server administrator to intercept private, encrypted messages. By exploiting a logic error in how encryption keys are shared between devices, an attacker who controls a participating server or a user's account can trick a victim's app into handing over the keys needed to read past conversations. This undermines the core privacy guarantee of end-to-end encryption for affected users.

Technologies: [Element Web](https://junglewise.ai/threats/technologies/element-web), [matrix-js-sdk (npm)](https://junglewise.ai/threats/technologies/matrix-js-sdk). Vendors: [Element](https://junglewise.ai/threats/vendors/element), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-40823 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-40823 being exploited in the wild.

**How severe is CVE-2021-40823?** Low severity, with a CVSS score of 3.1, published 14 September 2021.

**Which products and versions are affected?** Cinny <= 1.2.0; Element Desktop <= 1.8.2; Element Web <= 1.8.2; matrix-js-sdk (npm) SEMVER:introduced=0,fixed=12.4.1; and 2 more.

**Is there a fix for CVE-2021-40823?** Yes. matrix-js-sdk (npm): upgrade to 12.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-40823 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-40823?** Check whether you run Cinny, Element Desktop, Element Web or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-js-sdk (npm): upgrade to 12.4.1 or later

  ```sh
  npm install matrix-js-sdk@12.4.1
  ```


## Technical details

A logic error exists in the room key sharing functionality of matrix-js-sdk before version 12.4.1. The vulnerability stems from inadequate identity verification during the key re-sharing process (CWE-322/CWE-290), where the SDK fails to properly verify the target device key. A malicious Matrix homeserver participating in an encrypted room, or an attacker with access to a recipient's account, can send crafted protocol messages to trick a victim's client into disclosing E2EE keys for messages previously sent by that client. This allows the attacker to decrypt end-to-end encrypted communications. The issue is fixed in matrix-js-sdk v12.4.1 by ensuring target device keys are verified on reshare.

## Affected products

- Matrix.org matrix-js-sdk < 12.4.1
- Element Element Web <= 1.8.2
- Element Element Desktop <= 1.8.2
- SchildiChat SchildiChat Web <= 1.7.32-sc1
- SchildiChat SchildiChat Desktop <= 1.7.32-sc1
- Cinny Cinny <= 1.2.0

## Identifiers

- CVE-2021-40823
- GHSA-23cm-x6j7-6hq3

## Timeline

- 2021-09-13: patched: v12.4.1 released
- 2021-09-13: advisory: Vendor blog post disclosure
- 2021-09-14: disclosed: GitHub Advisory published

## References

- [https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-23cm-x6j7-6hq3](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-23cm-x6j7-6hq3)
- [https://github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51c0db80e3c9fb2be9](https://github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51c0db80e3c9fb2be9)
- [https://github.com/matrix-org/matrix-js-sdk](https://github.com/matrix-org/matrix-js-sdk)
- [https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.4.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v12.4.1)
- [https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing](https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing)

## Related threats

- [Element Web and Element Desktop URL fragment credential injection](https://junglewise.ai/threats/cve-2026-119407-element-web-and-element-desktop-before-1-12-32-accept-guest)
- [Element Web cross-site scripting in embedded page](https://junglewise.ai/threats/cve-2026-55850-element-web-cross-site-scripting-in-embedded-page)
- [Cinny access token disclosure via malicious emoji packs](https://junglewise.ai/threats/cve-2026-42553-cinny-access-token-disclosure-via-malicious-emoji-packs)
- [matrix-js-sdk insufficient validation in room upgrade handling](https://junglewise.ai/threats/cve-2025-59160-matrix-js-sdk-insufficient-validation-in-room-upgrade-handling)
- [matrix-js-sdk MXC URI path traversal](https://junglewise.ai/threats/cve-2024-50336-matrix-js-sdk-mxc-uri-path-traversal)