CVE-2020-26891: XSS Vulnerability in matrix-synapse
Summary
CVE-2020-26891: AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. Affects matrix-synapse versions < 1.21.0. Fixed in 1.21.0. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2020-26891 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix Synapse is an open-source server for the Matrix protocol, which enables secure communication and collaboration across different messaging platforms. It provides a decentralized and federated infrastructure for real-time communication. The vulnerability affects versions of Matrix Synapse prior to 1.21.0.
Vulnerability Detail
The AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to cross-site scripting (XSS) attacks. This vulnerability arises due to unsafe interpolation of the session GET parameter. An attacker can exploit this by providing a malicious URL to the /_matrix/client/r0/auth//fallback/web or /_matrix/client/unstable/auth//fallback/web endpoints. If a victim user clicks on the malicious URL, the attacker can execute arbitrary JavaScript code within the context of the targeted domain where Synapse is hosted. This can lead to various consequences, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim user.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.21.0
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.21.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling or blocking access to the vulnerable endpoints (/_matrix/client/r0/auth//fallback/web and /_matrix/client/unstable/auth//fallback/web) through appropriate network or web server configurations. This can help mitigate the risk of exploitation until the upgrade can be performed.
Conclusion
The XSS vulnerability in Matrix Synapse prior to version 1.21.0 poses a risk of remote code execution within the context of the targeted domain. Upgrading to the latest version or applying the provided workaround is essential to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code within the context of the targeted domain where Synapse is hosted. This can lead to various consequences, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim user.
You can use Vulert's playground (https://vulert.com/scanner) to check if your version of Matrix Synapse is affected by this vulnerability. Simply provide your Pipfile.lock and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this XSS vulnerability.
While specific exploits targeting this vulnerability have not been disclosed, it is important to promptly apply the recommended fix or workaround to mitigate the risk of exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can provide a malicious URL to a victim user, who, when clicking on the URL, triggers the execution of the malicious JavaScript code within the context of the targeted domain.
There is no specific evidence of active attacks exploiting this vulnerability at the moment. However, it is crucial to apply the recommended fix or workaround to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
