Description
AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to the /_matrix/client/r0/auth/*/fallback/web or /_matrix/client/unstable/auth/*/fallback/web Synapse endpoints.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | matrix-synapse | No fix yet | — |
| Ubuntu Pro 20.04 LTS | matrix-synapse | No fix yet | — |
| Ubuntu Pro 18.04 LTS | matrix-synapse | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | matrix-synapse | 1.43.0-1.1 | openSUSE-SU-2024:11041-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | synapse | 1.21.1-r0 | — |
| Alpine v3.23 | synapse | 1.21.1-r0 | — |
| Alpine v3.22 | synapse | 1.21.1-r0 | — |
| Alpine v3.21 | synapse | 1.21.1-r0 | — |
| Alpine v3.20 | synapse | 1.21.1-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | synapse | 1.21.1-r0 | — |
| Alpine v3.18 | synapse | 1.21.1-r0 | — |
| Alpine v3.17 | synapse | 1.21.1-r0 | — |
| Alpine v3.16 | synapse | 1.21.1-r0 | — |
| Alpine v3.15 | synapse | 1.21.1-r0 | — |
| Alpine v3.14 | synapse | 1.21.1-r0 | — |
| Alpine v3.13 | synapse | 1.21.1-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | matrix-synapse | < 1.21.0 | 1.21.0 | GHSA-3x8c-fmpc-5rmq |
Advisories 1
- openSUSE-SU-2024:11041-1 matrix-synapse-1.43.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026