CVE-2021-21392: Open Redirect Vulnerability in matrix-synapse
Summary
CVE-2021-21392: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Affects matrix-synapse versions < 1.28.0. Fixed in 1.28.0. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2021-21392 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-synapse is a Python-based Matrix reference homeserver that enables open federated Instant Messaging and VoIP. It serves as the backbone for the Matrix ecosystem. The vulnerability affects versions prior to 1.28.0 and involves unrestricted requests to user-provided domains when transitional IPv6 addresses are used. This can lead to requests being made to internal infrastructure on dual-stack networks, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability in matrix-synapse allows for unrestricted requests to user-provided domains, which can result in requests being made to internal infrastructure on dual-stack networks. This issue impacts various functionalities, including outbound requests to federation, identity servers, key validity calculation for third-party invite events, push notifications, and URL previews. Attackers can exploit this vulnerability to access internal resources and potentially perform unauthorized actions.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.28.0
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.28.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to update to the latest version of matrix-synapse as soon as possible.
Conclusion
The open redirect vulnerability in matrix-synapse can lead to unauthorized access to internal infrastructure on dual-stack networks. It is crucial to update to version 1.28.0 or later to mitigate this risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
matrix-synapse is a Python-based Matrix reference homeserver that enables open federated Instant Messaging and VoIP.
The vulnerability allows for unrestricted requests to user-provided domains, potentially leading to unauthorized access to internal infrastructure on dual-stack networks.
Versions prior to 1.28.0 of matrix-synapse are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to version 1.28.0 or later of matrix-synapse.
There is no specific workaround provided for this vulnerability. Updating to the latest version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
