matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator

{
  "id": "de03455fed229a0d00f8f91063160ac8bda91855f15632feaff9f50e6c71942b",
  "url": "https://osv.dev/vulnerability/RUSTSEC-2025-0041",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator",
    "summary": "matrix-sdk-crypto versions 0.8.0 up to and including 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. Although the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we consider this a High severity security issue.",
    "evidence": "osv:RUSTSEC-2025-0041",
    "products": [
      {
        "name": {
          "value": "matrix-sdk-crypto",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.11.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "RUSTSEC-2025-0041",
      "aliases": [
        "CVE-2025-48937",
        "GHSA-x958-rvg6-956w",
        "RUSTSEC-2025-0041"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0.8.0"
                },
                {
                  "fixed": "0.11.1"
                }
              ]
            }
          ],
          "package": {
            "name": "matrix-sdk-crypto",
            "purl": "pkg:cargo/matrix-sdk-crypto",
            "ecosystem": "crates.io"
          },
          "database_specific": {
            "cvss": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0041.json",
            "categories": [],
            "informational": null
          },
          "ecosystem_specific": {
            "affects": {
              "os": [],
              "arch": [],
              "functions": []
            },
            "affected_functions": null
          }
        }
      ],
      "modified": "2026-10-12T18:00:10.940253855Z",
      "provider": "osv",
      "references": [
        "https://crates.io/crates/matrix-sdk-crypto",
        "https://rustsec.org/advisories/RUSTSEC-2025-0041.html",
        "https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55"
      ],
      "provider_metadata": {
        "license": "CC0-1.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-48937",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 306408,
  "published_at": "2025-06-11T12:00:00+00:00"
}