CVE-2021-21332: Cross-site scripting (XSS) vulnerability in matrix-synapse
Summary
CVE-2021-21332: Cross-site scripting (XSS) vulnerability in the password reset endpoint. Affects matrix-synapse versions < 1.27.0. Fixed in 1.27.0. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2021-21332 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Matrix Synapse is an open-source messaging protocol and server implementation that enables secure communication and collaboration. It is widely used for decentralized communication platforms. The vulnerability identified as CVE-2021-21332 is a cross-site scripting (XSS) vulnerability in the password reset endpoint of Matrix Synapse.
Vulnerability Detail
The password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. This type of vulnerability allows an attacker to inject malicious scripts into web pages viewed by users. In the case of this vulnerability, an attacker could exploit it to access cookies and other browser data, perform CSRF attacks, and gain unauthorized access to resources served on the same domain or parent domains. The impact of the vulnerability depends on the configuration of the domain where Synapse is deployed.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.27.0
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.27.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Depending on the needs and configuration of the homeserver, there are a few options available:
- Disable password resets by delegating email to a third-party service or by not configuring the email setting.
- If the homeserver does not use passwords, the affected endpoint can be blocked at a reverse proxy.
- Override the 'password_reset_confirmation.html' template with a custom template that manually escapes the variables using Jinja2's 'escape' filter.
Conclusion
The cross-site scripting (XSS) vulnerability in Matrix Synapse's password reset endpoint can have serious security implications. It is crucial to update to version 1.27.0 or later to fix this vulnerability. Additionally, implementing the recommended workarounds can provide further protection. For more information and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
The impact depends on the configuration of the domain where Synapse is deployed. It may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.
Update Matrix Synapse to version 1.27.0 or later.
Yes, depending on the configuration, you can disable password resets, block the affected endpoint at a reverse proxy, or override the template with a custom one.
Yes, by delegating email to a third-party service, you can disable password resets and mitigate this vulnerability.
Yes, you can override the 'password_reset_confirmation.html' template with a custom template that manually escapes the variables using Jinja2's 'escape' filter.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
