CVE-2021-40824: Logic error in Matrix SDK for Android
Summary
CVE-2021-40824: Logic error in Matrix SDK for Android. Affects org.matrix.android:matrix-android-sdk2 versions < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Matrix SDK for Android, specifically the org.matrix.android:matrix-android-sdk2 package, is a Maven-based library that provides functionality for integrating Matrix communication protocol into Android applications. It allows developers to build chat and messaging features using the Matrix protocol. This vulnerability affects versions prior to 1.2.2 of the Element Android and matrix-android-sdk2 packages.
Vulnerability Detail
A logic error in the room key sharing functionality of Element Android and matrix-android-sdk2 leads to inadequate identity verification. This allows a key-requesting device to impersonate another device. The vulnerability arises from a flaw in the implementation of the key sharing mechanism, which fails to properly validate the identity of the requesting device. As a result, an attacker can exploit this vulnerability to impersonate another device and potentially gain unauthorized access to sensitive information or perform malicious actions on behalf of the impersonated device.
How To Fix
Latest published version: 1.6.62 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the Element Android and matrix-android-sdk2 packages.
Conclusion
In conclusion, the Matrix SDK for Android, specifically the Element Android and matrix-android-sdk2 packages, is vulnerable to a logic error that allows for impersonation of devices during key sharing. This can lead to unauthorized access and potential misuse of sensitive information. It is crucial for developers to upgrade to version 1.2.2 or later of the affected packages to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.matrix.android:matrix-android-sdk2 →
FAQ
This vulnerability allows an attacker to impersonate another device and potentially gain unauthorized access to sensitive information or perform malicious actions on behalf of the impersonated device.
Versions prior to 1.2.2 of the Element Android and matrix-android-sdk2 packages are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of the Element Android and matrix-android-sdk2 packages.
There are no known exploits for this vulnerability at the time of this report. However, it is essential to address the vulnerability promptly to mitigate the risk of potential exploitation.
More information about the Element Android and matrix-android-sdk2 packages can be found on the official GitHub repository and documentation of the respective projects.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.matrix.android:matrix-android-sdk2.
