CVE-2022-39248: Vulnerability in org.matrix.android:matrix-android-sdk2 - Olm/Megolm Protocol Confusion
Summary
CVE-2022-39248: matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion. Affects org.matrix.android:matrix-android-sdk2 versions < 1.5.1. Fixed in 1.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.matrix.android:matrix-android-sdk2 is an open-source software development kit (SDK) for building Matrix clients on the Android platform. It provides functionality for secure messaging and communication using the Matrix protocol. The SDK includes features such as end-to-end encryption, message synchronization, and user authentication. However, it is vulnerable to a protocol confusion issue related to the Olm/Megolm encryption protocols.
Vulnerability Detail
The vulnerability in org.matrix.android:matrix-android-sdk2 allows an attacker, in collaboration with a malicious homeserver, to construct messages that appear to have been sent by another user without any indication of tampering. This can lead to impersonation attacks and the injection of fake to-device messages. A sophisticated attacker could exploit this vulnerability to perform targeted attacks, such as injecting a malicious key backup during self-verification or spoofing a key backup signed by the matrix-android-sdk2 device. The vulnerability arises from the acceptance of to-device messages encrypted with Megolm instead of Olm.
How To Fix
Latest published version: 1.6.62 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As this attack requires coordination between a malicious homeserver and an attacker, if you trust your homeserver, no specific workaround is needed. However, as a precaution against malicious backup attacks, it is advised to avoid verifying new logins using emoji/QR verification methods until the vulnerability is patched. Instead, prefer using verification with a passphrase.
Conclusion
The vulnerability in org.matrix.android:matrix-android-sdk2 allows for protocol confusion, enabling attackers to send messages that appear to originate from another user. To mitigate this vulnerability, it is crucial to update to matrix-android-sdk2 version 1.5.1 or later. Additionally, caution should be exercised when verifying new logins and using backup methods. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.matrix.android:matrix-android-sdk2 →
FAQ
org.matrix.android:matrix-android-sdk2 is an open-source software development kit (SDK) for building Matrix clients on the Android platform. It provides functionality for secure messaging and communication using the Matrix protocol.
The vulnerability allows an attacker, in collaboration with a malicious homeserver, to send messages that appear to come from another user without any indication of tampering. This can lead to impersonation attacks and the injection of fake to-device messages.
The vulnerability can be fixed by updating to matrix-android-sdk2 version 1.5.1 or later. The updated version only accepts Olm-encrypted to-device messages and implements additional checks and measures to prevent protocol confusion.
If you trust your homeserver, no specific workaround is needed. However, as a precaution against malicious backup attacks, it is advised to avoid verifying new logins using emoji/QR verification methods until the vulnerability is patched. Instead, prefer using verification with a passphrase.
There is no known exploitation of this vulnerability in the wild. However, it is a sophisticated targeted attack that may be challenging to detect.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.matrix.android:matrix-android-sdk2.
