CVE-2025-68667
Gravedad CVSS v4.0:
CRÍTICA
Tipo:
CWE-20
Validación incorrecta de entrada
Fecha de publicación:
23/12/2025
Última modificación:
23/12/2025
Descripción
*** Pendiente de traducción *** continuwuity is a Matrix homeserver written in Rust. Prior to version 0.5.0, this vulnerability allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. This issue has been patched in version 0.5.0. A workaround for this issue involves blocking access to the PUT /_matrix/federation/v2/invite/{roomId}/{eventId} endpoint using the reverse proxy.
Impacto
Puntuación base 4.0
9.90
Gravedad 4.0
CRÍTICA