CVE-2022-39246: Impersonation Vulnerability in org.matrix.android:matrix-android-sdk2
Summary
CVE-2022-39246: matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions. Affects org.matrix.android:matrix-android-sdk2 versions < 1.5.1. Fixed in 1.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
org.matrix.android:matrix-android-sdk2 is an open-source software development kit (SDK) for Android applications that enables developers to integrate Matrix communication functionality into their apps. The SDK provides features such as end-to-end encryption, message synchronization, and key management. However, versions prior to 1.5.1 of the SDK are vulnerable to an impersonation attack via forwarded Megolm sessions.
Vulnerability Detail
The vulnerability allows an attacker who collaborates with a malicious homeserver to create messages that appear to originate from another person. While some platforms may display these messages with a grey shield, others may not provide any visual indication of the impersonation. The root cause of this vulnerability is the matrix-android-sdk2's implementation of a permissive key forwarding strategy on the receiving end. Key forwarding is a mechanism that allows clients to recover from 'unable to decrypt' messages by requesting and receiving the necessary encryption keys. However, the matrix-android-sdk2 accepts forwarded keys without proper verification, enabling an attacker to forge messages. This vulnerability can have serious consequences, as it undermines the integrity and trustworthiness of the communication platform.
How To Fix
Latest published version: 1.6.62 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Users of the matrix-android-sdk2 can disable key forwarding in their forks by using the 'CryptoService#enableKeyGossiping(enable: Boolean)' method.
Conclusion
The vulnerability in org.matrix.android:matrix-android-sdk2 allows attackers to impersonate other users and send forged messages. To mitigate this vulnerability, it is crucial to update to version 1.5.1 or later of the SDK and implement stricter key forwarding policies. Additionally, users can disable key forwarding as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.matrix.android:matrix-android-sdk2 →
FAQ
The vulnerability allows an attacker to impersonate other users and send messages that appear to come from them. This can lead to various malicious activities, such as spreading misinformation, conducting phishing attacks, or manipulating conversations.
To fix this vulnerability, you should update your implementation of the matrix-android-sdk2 to version 1.5.1 or later. Additionally, ensure that key forwarding is enabled only for trusted devices and that messages decrypted with untrusted keys are appropriately handled.
Yes, users can disable key forwarding in their forks of the matrix-android-sdk2 by using the 'CryptoService#enableKeyGossiping(enable: Boolean)' method.
Some platforms may display impersonated messages with a grey shield, but this visual indication may not be present in all cases. It is important to be cautious and verify the authenticity of messages, especially if they seem suspicious or unexpected.
You can refer to the blog post at https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients for more information about this vulnerability and its impact.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.matrix.android:matrix-android-sdk2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
