CVE-2025-68667
Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue
Description
Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10, continuwuity prior to version 0.5.0, Grapevine prior to commit `9a50c244`, and tuwunel prior to version 1.4.8. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. Attackers can forge "leave" events for any user on the target server. This forcibly removes users (including admins and bots) from rooms. This allows denial of service and/or the removal of technical protections for a room (including policy servers, if all users on the policy server are removed). Attackers can forge "invite" events from a victim user to themselves, provided they have an account on a server where there is an account that has the power level to send invites. This allows the attacker to join private or invite-only rooms accessible by the victim, exposing confidential conversation history and room state. Attackers can forge "ban" events from a victim user to any user below the victim user's power level, provided the victim has the power level to issue bans AND the target of the ban resides on the same server as the victim. This allows the attacker to ban anyone in a room who is on the same server as the vulnerable one, however cannot exploit this to ban users on other servers or the victim themself. Conduit fixes the issue in version 0.10.10. continuwuity fixes the issue in commits `7fa4fa98` and `b2bead67`, released in 0.5.0. tuwunel fixes the issue in commit `dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3`, released in 1.4.8. Grapevine fixes the issue in commit `9a50c2448abba6e2b7d79c64243bb438b351616c`. As a workaround, block access to the `PUT /_matrix/federation/v2/invite/{roomId}/{eventId}` endpoint using your reverse proxy.
INFO
Published Date :
Dec. 23, 2025, 11:15 p.m.
Last Modified :
Oct. 19, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Update Continuity to version 0.5.0 or later.
- Block access to the PUT /_matrix/federation/v2/invite/{roomId}/{eventId} endpoint via reverse proxy.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-68667.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-68667 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-68667
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-68667 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-68667 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 19, 2026
Action Type Old Value New Value Added Translation Title: continuwuity, Description: Conduit es un servidor de chat impulsado por Matrix. Una vulnerabilidad que afecta a varios servidores domésticos derivados de Conduit permite a un atacante remoto y no autenticado forzar al servidor objetivo a firmar criptográficamente eventos de membresía arbitrarios. Los productos afectados incluyen Conduit versiones anteriores a 0.10.10, continuwuity versiones anteriores a 0.5.0, Grapevine versiones anteriores al commit ’9a50c244’ y tuwunel versiones anteriores a 1.4.8. El problema existe porque el servidor no valida el origen de una solicitud de firma, siempre que la clave de estado (state_key) del evento sea un ID de usuario válido que pertenezca al servidor objetivo. \n\nLos atacantes pueden falsificar eventos de ’leave’ para cualquier usuario en el servidor objetivo. Esto elimina forzadamente a los usuarios (incluidos administradores y bots) de las salas. Permite una denegación de servicio y/o la eliminación de protecciones técnicas de una sala (incluidos los servidores de políticas, si se eliminan todos los usuarios del servidor de políticas). \n\nLos atacantes pueden falsificar eventos de ’invite’ de un usuario víctima hacia sí mismos, siempre que posean una cuenta en un servidor donde exista una cuenta con el nivel de poder necesario para enviar invitaciones. Esto permite al atacante unirse a salas privadas o solo por invitación accesibles por la víctima, exponiendo el historial confidencial de conversaciones y el estado de la sala. \n\nLos atacantes pueden falsificar eventos de ’ban’ de un usuario víctima hacia cualquier usuario con un nivel de poder inferior al de la víctima, siempre que la víctima tenga el nivel de poder para emitir baneos y el objetivo del baneo resida en el mismo servidor que la víctima. Esto permite al atacante banear a cualquier persona en una sala que esté en el mismo servidor que el vulnerable, aunque no puede explotarse para banear usuarios en otros servidores o a la propia víctima. \n\nConduit corrige el problema en la versión 0.10.10. continuwuity corrige el problema en los commits ’7fa4fa98’ y ’b2bead67’, publicados en la versión 0.5.0. tuwunel corrige el problema en el commit ’dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3’, publicado en la versión 1.4.8. Grapevine corrige el problema en el commit ’9a50c2448abba6e2b7d79c64243bb438b351616c’. \n\nComo solución alternativa, bloquee el acceso al endpoint ’PUT /_matrix/federation/v2/invite/{roomId}/{eventId}’ mediante su proxy inverso. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'continuwuity', 'product': 'continuwuity', 'versions': [{'status': 'affected', 'version': '< 0.5.0'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-68667', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-12-24T14:51:42.373847Z'} -
CVE Modified by [email protected]
Dec. 26, 2025
Action Type Old Value New Value Changed Description continuwuity is a Matrix homeserver written in Rust. Prior to version 0.5.0, this vulnerability allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. This issue has been patched in version 0.5.0. A workaround for this issue involves blocking access to the PUT /_matrix/federation/v2/invite/{roomId}/{eventId} endpoint using the reverse proxy. Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10, continuwuity prior to version 0.5.0, Grapevine prior to commit `9a50c244`, and tuwunel prior to version 1.4.8. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. Attackers can forge "leave" events for any user on the target server. This forcibly removes users (including admins and bots) from rooms. This allows denial of service and/or the removal of technical protections for a room (including policy servers, if all users on the policy server are removed). Attackers can forge "invite" events from a victim user to themselves, provided they have an account on a server where there is an account that has the power level to send invites. This allows the attacker to join private or invite-only rooms accessible by the victim, exposing confidential conversation history and room state. Attackers can forge "ban" events from a victim user to any user below the victim user's power level, provided the victim has the power level to issue bans AND the target of the ban resides on the same server as the victim. This allows the attacker to ban anyone in a room who is on the same server as the vulnerable one, however cannot exploit this to ban users on other servers or the victim themself. Conduit fixes the issue in version 0.10.10. continuwuity fixes the issue in commits `7fa4fa98` and `b2bead67`, released in 0.5.0. tuwunel fixes the issue in commit `dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3`, released in 1.4.8. Grapevine fixes the issue in commit `9a50c2448abba6e2b7d79c64243bb438b351616c`. As a workaround, block access to the `PUT /_matrix/federation/v2/invite/{roomId}/{eventId}` endpoint using your reverse proxy. Added Reference https://github.com/matrix-construct/tuwunel/commit/dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3 Added Reference https://gitlab.com/famedly/conduit/-/releases/v0.10.10 Added Reference https://gitlab.computer.surgery/matrix/grapevine/-/commit/9a50c2448abba6e2b7d79c64243bb438b351616c -
New CVE Received by [email protected]
Dec. 23, 2025
Action Type Old Value New Value Added Description continuwuity is a Matrix homeserver written in Rust. Prior to version 0.5.0, this vulnerability allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. This issue has been patched in version 0.5.0. A workaround for this issue involves blocking access to the PUT /_matrix/federation/v2/invite/{roomId}/{eventId} endpoint using the reverse proxy. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-20 Added CWE CWE-441 Added Reference https://forgejo.ellis.link/continuwuation/continuwuity/commit/7fa4fa98628593c1a963f5aa8dbc3657d604b047 Added Reference https://forgejo.ellis.link/continuwuation/continuwuity/commit/b2bead67ac8bc45de9a612578f295e5b7fc6c2b5 Added Reference https://github.com/continuwuity/continuwuity/security/advisories/GHSA-22fw-4jq7-g8r8