Reported

June 3, 2026

Issued

June 4, 2026

Package

matrix-sdk-crypto (crates.io)

Type

Vulnerability

Aliases

• CVE-2026-45056
• GHSA-wfq4-36m3-9g42

References

• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-wfq4-36m3-9g42

Patched

• >=0.16.1

Unaffected

• <0.12.0

Description

The matrix-sdk-crypto crate before 0.16.1 is missing a check for the sender's user ID when decrypting an Olm-encrypted to-device message containing the sender_device_keys property.

This could be exploited to spoof the sender of an encrypted to-device message, but only if the attacker colludes with (or is) the homeserver operator.

Advisory available under CC0-1.0 license.