Email Domain Misconfiguration in Matrix Sydent by Matrix
CVE-2019-11340

5.9MEDIUM

Key Information:

Vendor: Matrix
Status: Sydent
Vendor: CVE Published:; 19 April 2019

What is CVE-2019-11340?

The Matrix Sydent service, specifically the util/emailutils.py module, has a vulnerability that arises from improper handling of registration restrictions tied to email domains. When the allowed_local_3pids option is enabled, the email.utils.parseaddr function can yield unexpected results. This could allow a user to bypass intended restrictions by using email formats that confuse the parser, potentially leading to unwanted registrations with unauthorized domains.