High severity8.6NVD Advisory· Published Sep 29, 2022· Updated Jun 17, 2026
CVE-2022-39254
CVE-2022-39254
Description
matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
matrix-nioPyPI | < 0.20 | 0.20 |
Affected products
2- Range: < 0.20
Patches
Vulnerability mechanics
References
4- github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-w4pr-4vjg-hffhghsaADVISORY
- github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffhnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-39254ghsaADVISORY
News mentions
0No linked articles in our index yet.