CVE-2020-26257

Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).

• CWE-79
• CWE-400
• CWE-400

• https://github.com/matrix-org/synapse/blob/develop/CHANGES.md#synapse-1231-2020-12-09Release Notes, Third Party Advisory
• https://github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8bPatch, Third Party Advisory
• https://github.com/matrix-org/synapse/pull/8776Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mmThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DBTIU3ZNBFWZ56V4X7JIAD33V5H2GOMC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QR4MMYZKX5N5GYGH4H5LBUUC5TLAFHI7/
• https://github.com/matrix-org/synapse/blob/develop/CHANGES.md#synapse-1231-2020-12-09Release Notes, Third Party Advisory
• https://github.com/matrix-org/synapse/commit/3ce2f303f15f6ac3dc352298972dc6e04d9b7a8bPatch, Third Party Advisory
• https://github.com/matrix-org/synapse/pull/8776Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-hxmp-pqch-c8mmThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DBTIU3ZNBFWZ56V4X7JIAD33V5H2GOMC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QR4MMYZKX5N5GYGH4H5LBUUC5TLAFHI7/

Published

Dec 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26251Open Zaak is a modern, open-source data- and services-layer …4.7
• CVE-2020-26252OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26253Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3…5.9
• CVE-2020-26254omniauth-apple is the OmniAuth strategy for "Sign In with Ap…7.7
• CVE-2020-26255Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3…9.1
• CVE-2020-26256Fast-csv is an npm package for parsing and formatting CSVs o…6.5
• CVE-2020-26258XStream is a Java library to serialize objects to XML and ba…7.7
• CVE-2020-26259XStream is a Java library to serialize objects to XML and ba…6.8
• CVE-2020-2626Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26260BookStack is a platform for storing and organising informati…6.4
• CVE-2020-26261jupyterhub-systemdspawner enables JupyterHub to spawn single…7.9
• CVE-2020-26262Coturn is free open source implementation of TURN and STUN S…7.2