CVE-2025-61672: Matrix Synapse Device Key Validation Vulnerability
Summary
CVE-2025-61672: Synapse's invalid device keys degrade federation functionality. Affects matrix-synapse across 2 version ranges.
< 1.138.3
>= 1.139.0rc2, < 1.139.1
Fixed in 1.138.3 or 1.139.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix Synapse is an open-source server for Matrix, a decentralized communication protocol. It enables real-time communication and collaboration across various platforms. Synapse is widely used for its scalability and flexibility, allowing users to create and manage their own communication servers. However, prior versions of Synapse are vulnerable to a security issue that compromises federation functionality due to inadequate validation of device keys.
Vulnerability Detail
The vulnerability arises from a lack of validation for device keys in Synapse versions before 1.138.3 and in version 1.139.0. This flaw allows attackers who are registered on the victim's homeserver to degrade federation functionality, potentially disrupting outbound federation to other homeservers. The impact of this vulnerability can lead to unpredictable behavior in communication, affecting the reliability of the service.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.138.31.138.3pip install --upgrade "matrix-synapse==1.138.3" -
>= 1.139.0rc2, < 1.139.11.139.1pip install --upgrade "matrix-synapse==1.139.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
The vulnerability can only be exploited by users registered on the victim homeserver. Therefore, restricting access to the homeserver and monitoring registered users can serve as a temporary workaround until the package is updated.
Conclusion
The vulnerability identified as CVE-2025-61672 in Matrix Synapse poses a significant risk to federation functionality due to improper validation of device keys. Users are urged to update to the patched versions to ensure the security and reliability of their communication services.
See every vulnerability recorded for matrix-synapse →
FAQ
The vulnerability is due to a lack of validation for device keys, allowing registered users to disrupt federation functionality.
Versions before 1.138.3 and 1.139.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
It is recommended to update to versions 1.138.4 or 1.139.2 to mitigate the vulnerability.
The CVSS score for this vulnerability is 5.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
