CVE-2026-63095
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Dendrite through version 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users. Attackers can exploit the unverified Forget3PID handler to remove a victim's email or MSISDN binding and subsequently rebind the address through an identity server to hijack the victim's password reset flow.
Risk Assessment
The risk for the organization includes the possibility of user account takeover through manipulation of the password reset process, potentially leading to unauthorized access to sensitive data and system integrity compromise.
Recommendation
It is recommended to immediately upgrade Dendrite to version 0.13.9 or later, which includes a fix for this vulnerability. Additionally, verify that no unauthorized changes to third-party identifier bindings have occurred.
Other vulnerabilities in Dendrite
See all- CVE-2026-63097Medium
Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint. It allows authenticated local users to access post-leave room state events by exploiting a flawed membership check.
- CVE-2026-63096Medium
Dendrite up to version 0.13.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers can exploit distinguishable error response classes and leaked internal IP addresses in error messages to perform blind port scanning and enumerate internal network topology.
Original NVD description (English source)
Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users by submitting an arbitrary address and medium to the account deletion endpoint without ownership verification. Attackers can exploit the unverified Forget3PID handler to remove a victim's email or MSISDN binding and subsequently rebind the address through an identity server to hijack the victim's password reset flow.