Matrix Homeserver Vulnerability in Continuwuity Software by Continuwuity

CVE-2025-68667

What is CVE-2025-68667?

The Continuwuity Matrix homeserver has a significant vulnerability that enables an unauthenticated remote attacker to manipulate the server into cryptographically signing arbitrary membership events. This occurs due to a failure in the server's validation process for the origin of signing requests when the state_key corresponds to a valid user ID associated with the target server. The vulnerability has been addressed in version 0.5.0, and a temporary workaround is to restrict access to the endpoint responsible for handling invite requests via a reverse proxy. This highlights the need for robust security protocols to prevent unauthorized access.

References