Executive brief
matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
Affected products
- crates.io matrix-sdk-crypto
Junglewise Threat Intelligence
CVE-2025-48937: RUSTSEC-2025-0041 - matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
CVE-2025-48937 · Severity: low · CVSS 3.1 · Published 2025-06-11
Technologies: matrix-sdk-crypto (crates.io). Vendors: crates.io.
Related threats
- matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in ve
- RUSTSEC-2024-0356 - `UserIdentity::is_verified` not checking verification status of own user identity while performing the check
- matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
- RUSTSEC-2024-0434 - Missing facility to signal rotation of a verified cryptographic identity
- RUSTSEC-2022-0085 - matrix-sdk Impersonation of room keys