CVE-2020-26891

AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints.

• CWE-79

• https://github.com/matrix-org/synapse/pull/8444Issue Tracking, Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.21.2Release Notes, Third Party Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmqPatch, Third Party Advisory
• https://matrix.org/blog/2020/10/15/synapse-1-21-2-released-and-security-advisoryRelease Notes, Vendor Advisory
• https://github.com/matrix-org/synapse/pull/8444Issue Tracking, Patch, Third Party Advisory
• https://github.com/matrix-org/synapse/releases/tag/v1.21.2Release Notes, Third Party Advisory
• https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmqPatch, Third Party Advisory
• https://matrix.org/blog/2020/10/15/synapse-1-21-2-released-and-security-advisoryRelease Notes, Vendor Advisory

Published

Oct 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26884RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL inject…6.1
• CVE-2020-26885An issue was discovered in 2sic 2sxc before 11.22. A XSS vul…6.1
• CVE-2020-26886Softaculous before 5.5.7 is affected by a code execution vul…7.8
• CVE-2020-26887FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of…7.8
• CVE-2020-2689Vulnerability in the Oracle VM VirtualBox product of Oracle …6.5
• CVE-2020-26890Matrix Synapse before 1.20.0 erroneously permits non-standar…7.5
• CVE-2020-26892The JWT library in NATS nats-server before 2.1.9 has Incorre…9.8
• CVE-2020-26893An issue was discovered in ClamXAV 3 before 3.1.1. A malicio…7.8
• CVE-2020-26894LiveCode v9.6.1 on Windows allows local, low-privileged user…7.8
• CVE-2020-26895Prior to 0.10.0-beta, LND (Lightning Network Daemon) would h…5.3
• CVE-2020-26896Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a v…8.2
• CVE-2020-26897Certain NETGEAR devices are affected by disclosure of admini…8.8