matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

EPSS

• CVE-2022-39250: 1.19% estimated exploitation activity in the next 30 days; percentile 67.90 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities, leading to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Patches The matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made…

Published by the source

30 Sep 2022, 22:46 UTC

Last modified by the source

8 Nov 2023, 04:10 UTC

Source last checked

26 Oct 2026, 12:17 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-5w8r-8pgj-5jmf

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-5w8r-8pgj-5jmf

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2022-39250

Advisory: matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification
IDs: CVE-2022-39250, GHSA-5w8r-8pgj-5jmf
Record: https://patchnext.com/advisories/cve-2022-39250 (revision 2, source checked 26 Oct 2026, 12:17 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: matrix-js-sdk 19.7.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm matrix-js-sdk: affected < 19.7.0; fixed in 19.7.0

## Suggested inspection (read-only)
- `npm ls matrix-js-sdk --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on matrix-js-sdk.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-5w8r-8pgj-5jmf (OSV record GHSA-5w8r-8pgj-5jmf lists affected ranges: npm matrix-js-sdk >=0 <19.7.0 (fixed))
- Verified: https://github.com/advisories/GHSA-5w8r-8pgj-5jmf (GitHub-reviewed advisory GHSA-5w8r-8pgj-5jmf lists affected ranges: npm matrix-js-sdk >=0 <19.7.0)

Commands are suggestions: review each one before running it.