Skip to content
OpenAdvisories

Package · npm

matrix-appservice-bridge

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.0
    CVE-2023-38691

    matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs

    matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when usi…

    Matrix matrix-appservice-bridge matrix-appservice-bridge npm
  • Medium 6.5
    CVE-2021-32659

    Automatic room upgrade handling can be used maliciously to bridge a room non-consentually

    Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a n…

    Matrix matrix-appservice-bridge matrix-appservice-bridge npm