CVE-2025-68667

Full vulnerability record from the local CVENow database.

Description

Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10, continuwuity prior to version 0.5.0, Grapevine prior to commit `9a50c244`, and tuwunel prior to version 1.4.8. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. Attackers can forge "leave" events for any user on the target server. This forcibly removes users (including admins and bots) from rooms. This allows denial of service and/or the removal of technical protections for a room (including policy servers, if all users on the policy server are removed). Attackers can forge "invite" events from a victim user to themselves, provided they have an account on a server where there is an account that has the power level to send invites. This allows the attacker to join private or invite-only rooms accessible by the victim, exposing confidential conversation history and room state. Attackers can forge "ban" events from a victim user to any user below the victim user's power level, provided the victim has the power level to issue bans AND the target of the ban resides on the same server as the victim. This allows the attacker to ban anyone in a room who is on the same server as the vulnerable one, however cannot exploit this to ban users on other servers or the victim themself. Conduit fixes the issue in version 0.10.10. continuwuity fixes the issue in commits `7fa4fa98` and `b2bead67`, released in 0.5.0. tuwunel fixes the issue in commit `dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3`, released in 1.4.8. Grapevine fixes the issue in commit `9a50c2448abba6e2b7d79c64243bb438b351616c`. As a workaround, block access to the `PUT /_matrix/federation/v2/invite/{roomId}/{eventId}` endpoint using your reverse proxy.

Severity

CRITICAL

CVSS score

9.9 (v4.0)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2025-12-23 23:15:45.280000

Last modified

2026-10-19 22:10:00.130000

View original CVE JSON

{
  "id": "CVE-2025-68667",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-23T23:15:45.280",
  "lastModified": "2026-10-19T22:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10, continuwuity prior to version 0.5.0, Grapevine prior to commit `9a50c244`, and tuwunel prior to version 1.4.8. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. Attackers can forge \"leave\" events for any user on the target server. This forcibly removes users (including admins and bots) from rooms. This allows denial of service and/or the removal of technical protections for a room (including policy servers, if all users on the policy server are removed). Attackers can forge \"invite\" events from a victim user to themselves, provided they have an account on a server where there is an account that has the power level to send invites. This allows the attacker to join private or invite-only rooms accessible by the victim, exposing confidential conversation history and room state. Attackers can forge \"ban\" events from a victim user to any user below the victim user's power level, provided the victim has the power level to issue bans AND the target of the ban resides on the same server as the victim. This allows the attacker to ban anyone in a room who is on the same server as the vulnerable one, however cannot exploit this to ban users on other servers or the victim themself. Conduit fixes the issue in version 0.10.10. continuwuity fixes the issue in commits `7fa4fa98` and `b2bead67`, released in 0.5.0. tuwunel fixes the issue in commit `dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3`, released in 1.4.8. Grapevine fixes the issue in commit `9a50c2448abba6e2b7d79c64243bb438b351616c`. As a workaround, block access to the `PUT /_matrix/federation/v2/invite/{roomId}/{eventId}` endpoint using your reverse proxy."
    },
    {
      "lang": "es",
      "value": "Conduit es un servidor de chat impulsado por Matrix. Una vulnerabilidad que afecta a varios servidores domésticos derivados de Conduit permite a un atacante remoto y no autenticado forzar al servidor objetivo a firmar criptográficamente eventos de membresía arbitrarios. Los productos afectados incluyen Conduit versiones anteriores a 0.10.10, continuwuity versiones anteriores a 0.5.0, Grapevine versiones anteriores al commit ’9a50c244’ y tuwunel versiones anteriores a 1.4.8. El problema existe porque el servidor no valida el origen de una solicitud de firma, siempre que la clave de estado (state_key) del evento sea un ID de usuario válido que pertenezca al servidor objetivo.  \\n\\nLos atacantes pueden falsificar eventos de ’leave’ para cualquier usuario en el servidor objetivo. Esto elimina forzadamente a los usuarios (incluidos administradores y bots) de las salas. Permite una denegación de servicio y/o la eliminación de protecciones técnicas de una sala (incluidos los servidores de políticas, si se eliminan todos los usuarios del servidor de políticas).  \\n\\nLos atacantes pueden falsificar eventos de ’invite’ de un usuario víctima hacia sí mismos, siempre que posean una cuenta en un servidor donde exista una cuenta con el nivel de poder necesario para enviar invitaciones. Esto permite al atacante unirse a salas privadas o solo por invitación accesibles por la víctima, exponiendo el historial confidencial de conversaciones y el estado de la sala.  \\n\\nLos atacantes pueden falsificar eventos de ’ban’ de un usuario víctima hacia cualquier usuario con un nivel de poder inferior al de la víctima, siempre que la víctima tenga el nivel de poder para emitir baneos y el objetivo del baneo resida en el mismo servidor que la víctima. Esto permite al atacante banear a cualquier persona en una sala que esté en el mismo servidor que el vulnerable, aunque no puede explotarse para banear usuarios en otros servidores o a la propia víctima.  \\n\\nConduit corrige el problema en la versión 0.10.10. continuwuity corrige el problema en los commits ’7fa4fa98’ y ’b2bead67’, publicados en la versión 0.5.0. tuwunel corrige el problema en el commit ’dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3’, publicado en la versión 1.4.8. Grapevine corrige el problema en el commit ’9a50c2448abba6e2b7d79c64243bb438b351616c’.  \\n\\nComo solución alternativa, bloquee el acceso al endpoint ’PUT /_matrix/federation/v2/invite/{roomId}/{eventId}’ mediante su proxy inverso."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "continuwuity",
          "product": "continuwuity",
          "versions": [
            {
              "version": "< 0.5.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "LOW",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-24T14:51:42.373847Z",
          "id": "CVE-2025-68667",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-441"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://forgejo.ellis.link/continuwuation/continuwuity/commit/7fa4fa98628593c1a963f5aa8dbc3657d604b047",
      "source": "[email protected]"
    },
    {
      "url": "https://forgejo.ellis.link/continuwuation/continuwuity/commit/b2bead67ac8bc45de9a612578f295e5b7fc6c2b5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/continuwuity/continuwuity/security/advisories/GHSA-22fw-4jq7-g8r8",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/matrix-construct/tuwunel/commit/dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.com/famedly/conduit/-/releases/v0.10.10",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.computer.surgery/matrix/grapevine/-/commit/9a50c2448abba6e2b7d79c64243bb438b351616c",
      "source": "[email protected]"
    }
  ]
}