Password Exposure in Element Call Video Conferencing Application by Matrix

CVE-2026-62347

What is CVE-2026-62347?

Element Call, a video conferencing application from Matrix, has a vulnerability where it logs the password URL query parameter in versions 0.16.0 to 0.20.3. This sensitive information can be unintentionally shared with the application operator when users submit error reports through a feature called 'rageshake'. This exposure can compromise the confidentiality of calls as the shared password is integral to encrypting the call. Although the issue is fixed in version 0.20.3, users of the affected versions should refrain from submitting bug reports or debug logs to prevent password disclosures. Past rageshakes retain the sensitive data, which requires manual cleanup by the log-server operator.

References