CVE-2025-68667
Severity CVSS v4.0:
CRITICAL
Type:
CWE-20
Input Validation
Publication date:
23/12/2025
Last modified:
23/12/2025
Description
continuwuity is a Matrix homeserver written in Rust. Prior to version 0.5.0, this vulnerability allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. This issue has been patched in version 0.5.0. A workaround for this issue involves blocking access to the PUT /_matrix/federation/v2/invite/{roomId}/{eventId} endpoint using the reverse proxy.
Impact
Base Score 4.0
9.90
Severity 4.0
CRITICAL