CVE-2025-68667

Conduit, a Matrix-powered chat server, has a vulnerability allowing a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to 0.10.10, continuwuity prior to 0.5.0, Grapevine prior to commit `9a50c244`, and tuwunel prior to 1.4.8. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. Attackers can forge "leave" events for any user, forcibly removing users (including admins and bots) from rooms, leading to denial of service and/or removal of technical protections. They can also forge "invite" events from a victim to themselves if they have an account on a server where...

The risk includes denial of service by removing admins and bots from rooms, potentially disrupting chat services and removing technical protections, including policy servers.

Immediately update Conduit to 0.10.10 or later, continuwuity to 0.5.0 or later, Grapevine to commit `9a50c244` or later, and tuwunel to 1.4.8 or later.