Rust advisories / matrix-sdk-crypto
Vulnerability MediumRUSTSEC-2024-0356 · matrix-sdk-crypto
RUSTSEC-2024-0356: `UserIdentity::is_verified` not checking verification status of own user identity while performing the check
Short answerA security vulnerability in the matrix-sdk-crypto crate: `UserIdentity::is_verified` not checking verification status of own user identity while performing the check. GitHub rates it Medium. Fixed in 0.7.2: update to a fixed version.
| Crate | matrix-sdk-crypto |
|---|---|
| Type | Vulnerability (crypto-failure) |
| Affected versions | Before 0.7.2. |
| Fixed in | 0.7.2 |
| Severity | Medium (GitHub rating) |
| Published | 2024-07-18 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2024-40648, GHSA-4qg4-cvh2-crgg |
| Affected functions | matrix_sdk_crypto::UserIdentity::is_verified |
What to do
- See which version you have:
cargo tree -i matrix-sdk-crypto(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p matrix-sdk-crypto. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplematrix-sdk-crypto = "0.7.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The UserIdentity::is_verified() method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation.
Impact
If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the matrix-sdk-crypto crate.
References
- Package: crates.io/crates/matrix-sdk-crypto
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0356.html
- Web: github.com/matrix-org/matrix-rust-sdk/commit/76a7052149bb8f722df12da915b3a06d19a6695a
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for matrix-sdk-crypto
- Vulnerability HighRUSTSEC-2022-0085 · 2022-09-29matrix-sdk Impersonation of room keys
- NoticeRUSTSEC-2024-0434 · 2024-01-07 Missing facility to signal rotation of a verified cryptographic identity
- Vulnerability MediumRUSTSEC-2025-0041 · 2025-06-11matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
- VulnerabilityRUSTSEC-2026-0159 · 2026-06-03Sender-binding gaps in to-device messages
- VulnerabilityRUSTSEC-2026-0318 · 2026-09-29Sending custom to-device messages may panics
- VulnerabilityGHSA-9ggc-845v-gcgv · 2024-05-13matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
Up next
Same cratematrix-sdk-crypto: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?