CVE-2026-45056

Executive Summary

CVE-2026-45056 is an authentication bypass vulnerability in the matrix-sdk-crypto Rust crate, a state machine implementation for Matrix end-to-end encryption. In versions 0.12.0 through 0.16.x, the library failed to verify the user ID when decrypting an Olm-encrypted event containing the sender_device_keys property. An attacker who colludes with a malicious homeserver operator can forge an encrypted to-device event, potentially impersonating another user. The issue is fixed in version 0.17.0; no workarounds are available.

Technical Analysis

The vulnerability resides in the cryptographic state machine of matrix-sdk-crypto, which handles Olm-encrypted to-device events in Matrix clients. Olm is the Double Ratchet-based protocol used for device-to-device encryption in Matrix. To-device events are used for key exchange, room key distribution, and other out-of-band signaling between devices. The sender_device_keys property is a field that accompanies such events and contains metadata about the sender's device keys—information necessary for establishing or verifying the encryption session.

The core flaw is classified as CWE-290: Authentication Bypass by Spoofing. Specifically, when decrypting an Olm-encrypted event that carried the sender_device_keys property, the library did not check the user ID associated with those keys against the user ID of the actual message sender. This means the cryptographic binding between the claimed sender identity and the presented device keys was not validated. An attacker who controls or colludes with the homeserver can inject a crafted to-device event that presents arbitrary sender_device_keys (e.g., keys belonging to a victim user) without the receiving client detecting the mismatch.

The exploitation precondition—collusion with the homeserver operator—is significant. In the Matrix federation model, the homeserver is responsible for routing to-device events and could, in theory, alter or originate events. The missing user ID check means the client-side library trusted the embedded sender metadata without cross-referencing it against the authenticated sender context. This undermines the end-to-end encryption guarantee that a message originates from the claimed device.

From a code-level perspective, the fix in 0.17.0 presumably introduces a validation step that compares the user ID from the decrypted event's sender_device_keys to the expected sender identity (likely derived from the Olm session or the event envelope) and rejects the event on mismatch. The NVD description does not specify the exact function, module, or parameter names beyond sender_device_keys, so no further implementation details can be asserted.

The attack surface is limited to Matrix clients using affected versions of matrix-sdk-crypto that process to-device events with embedded sender_device_keys. This includes applications built on the Matrix Rust SDK (e.g., Element X, other Rust-based clients) and any downstream consumers of the crate. The lack of network IO in the library itself means the vulnerability is in the cryptographic state machine logic, not in transport handling.

Exploitation Scenarios

1. Reconnaissance/target identification: The attacker first identifies a target deploying a Matrix client with matrix-sdk-crypto versions 0.12.0 to <0.17.0. This could be any user or organization using a vulnerable client. The attacker must also control or collude with the homeserver operator that serves the victim's account, or be in a position to inject to-device events into the victim's stream (e.g., a malicious federated homeserver that the victim communicates with).

2. Triggering the flaw: The attacker, via the colluding homeserver, crafts an Olm-encrypted to-device event that includes a sender_device_keys property containing the keys of a victim user (or an arbitrary identity). When the vulnerable client decrypts this event, it fails to check that the user ID associated with sender_device_keys matches the actual sender of the event, as derived from the authenticated Olm session or event context. As a result, the client accepts the forged keys as belonging to the victim.

3. Payload/execution method: At the vulnerability-class level, this is a spoofing attack. The attacker does not need to exploit memory corruption or inject code; instead, they abuse the missing authentication check to have the client treat the attacker's device as the victim's device. The payload is the crafted to-device event with mismatched sender_device_keys. The exact structure of the event and the encryption process follow the Matrix Olm protocol; no specific function names are available from the description. No public PoC is available; the attack chain is inferred from the vulnerability class.

4. Post-exploitation impact: Successful exploitation allows the attacker to forge encrypted to-device events that appear to come from the victim. This could enable the attacker to impersonate the victim in device-to-device communications, potentially leading to trust establishment with the victim's contacts, interception of session keys, or injection of malicious devices. The integrity impact is high, as the attacker can tamper with the cryptographic identity binding. Confidentiality and availability are not directly impacted per the CVSS vector, but downstream effects (e.g., social engineering, further key compromise) could escalate the risk.

Impact Assessment

The vulnerability has a CVSS 3.1 base score of N/A (not provided) but the vector derived from the description indicates: AV:N (network exploitable), AC:H (high complexity due to required homeserver collusion), PR:N (no privileges required), UI:N (no user interaction), S:U (scope unchanged), C:N (no confidentiality impact), I:H (high integrity impact), A:N (no availability impact). The high attack complexity reflects the precondition of homeserver collusion, which limits the blast radius compared to a remotely exploitable flaw without preconditions.

Affected systems include any application built on matrix-sdk-crypto versions 0.12.0 to <0.17.0. This primarily affects Rust-based Matrix clients and SDKs. Organizations that use Matrix for secure communication, especially those relying on end-to-end encryption for sensitive data, are at risk if their client software is unpatched. The blast radius is constrained by the need for a malicious or compromised homeserver, but in federated environments or with untrusted homeservers, the risk is non-trivial. The integrity of the encryption trust model is compromised, which could erode user confidence in the platform.

Business impact: For enterprises using Matrix for internal communication, a successful spoofing attack could lead to data leakage, unauthorized access to encrypted rooms, or reputational damage. However, the high complexity and collusion requirement mean widespread exploitation is unlikely without a targeted campaign.

Detection Guidance

Detection of this vulnerability is challenging because it occurs within the cryptographic processing of the client and does not involve obvious network signatures. However, monitoring for anomalous to-device events, especially those with sender_device_keys that do not match the sender's expected identity, can help. The following rules are heuristic and should be tuned.

Sigma Rule

title: Potential Matrix Olm Event Spoofing via sender_device_keys Mismatch
id: 8f2a1c3e-4b5d-6e7f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects decryption of Olm to-device events with sender_device_keys that do not match the sender user ID, indicating CVE-2026-45056 exploitation.
author: Valters IT Threat Intel
date: 2026-04-10
logsource:
    product: matrix
    service: client
detection:
    selection:
        event_type: 'm.room.encrypted'
        algorithm: 'm.olm.v1.curve25519-aes-sha2'
        contains: 'sender_device_keys'
    filter_legit:
        user_id_matches: true
    condition: selection and not filter_legit
falsepositives:
    - Legitimate key changes during device verification
level: high
tags:
    - attack.t1557
    - cve.2026.45056

YARA Rule

rule CVE_2026_45056_Matrix_SDK_Crypto_Missing_UserID_Check
{
    meta:
        description = "Detects vulnerable matrix-sdk-crypto versions lacking user ID check for sender_device_keys"
        author = "Valters IT Threat Intel"
        date = "2026-04-10"
        cve = "CVE-2026-45056"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-45056"
    strings:
        $s1 = "sender_device_keys" ascii wide nocase
        $s2 = "matrix-sdk-crypto" ascii wide nocase
        $v1 = "0.12." ascii wide
        $v2 = "0.13." ascii wide
        $v3 = "0.14." ascii wide
        $v4 = "0.15." ascii wide
        $v5 = "0.16." ascii wide
    condition:
        ($s1 and $s2) and any of ($v*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-45056 Matrix Olm Event with sender_device_keys Spoofing Attempt"; flow:to_client,established; content:"sender_device_keys"; nocase; content:"m.olm.v1.curve25519-aes-sha2"; nocase; distance:0; within:500; threshold: type limit, track by_src, count 1, seconds 60; classtype:attempted-user; sid:10000001; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.name == "element" or process.name == "matrix-sdk"]
  [network where network.protocol == "matrix" and event.action == "decrypt" and
   network.transport == "tcp" and
   process.name == "element" and
   contains(network.payload, "sender_device_keys") and
   not contains(network.payload, "user_id_matches")]

Splunk SPL Query

index=matrix sourcetype=matrix:client_logs
| search "sender_device_keys" AND ("decrypt" OR "olm") AND NOT "user_id_match"
| stats count by src_user, dest_user, event_type, sender_device_keys
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="matrix,">
  <rule id="100100" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">m.room.encrypted</field>
    <field name="algorithm">m.olm.v1.curve25519-aes-sha2</field>
    <field name="sender_device_keys">\.+</field>
    <description>CVE-2026-45056: Possible Matrix Olm event spoofing - sender_device_keys present without matching user ID</description>
    <mitre>
      <id>T1557</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in matrix-sdk-crypto 0.17.0, but no official patch source or vendor advisory is available in the provided data.

1. Immediate mitigations: Since no workarounds are known per the description, immediate mitigation is limited. Organizations should:

   • Upgrade to matrix-sdk-crypto 0.17.0 or later as soon as possible, as the description indicates it contains the fix.
   • If upgrade is not immediately possible, restrict the use of affected Matrix clients for sensitive communications and consider alternative secure messaging solutions.
   • Monitor logs for anomalous to-device events with sender_device_keys that may indicate spoofing attempts.
   • Limit federation with untrusted homeservers or disable federation if feasible, to reduce the attack surface requiring collusion.

2. Patch/upgrade steps: Update the matrix-sdk-crypto crate to version 0.17.0. For applications using the crate, update dependencies to the latest compatible version and rebuild. Verify the update by checking the crate version in Cargo.lock or equivalent. Since the vendor fix is not detailed, consult the official Matrix SDK repository or advisory for the specific patch commit.

3. Long-term hardening:

   • Implement rigorous validation of sender identity in cryptographic protocols; always cross-check user IDs against authenticated session data.
   • Adopt defense-in-depth: even if a homeserver is malicious, client-side checks should prevent impersonation.
   • Regularly update cryptographic libraries and monitor security advisories for the Matrix ecosystem.
   • Conduct code reviews focusing on authentication checks in encryption/decryption paths.
   • Consider using hardware-backed keys or additional verification steps for high-value communications.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45056
• Matrix SDK Repository (matrix-sdk-crypto): https://github.com/matrix-org/matrix-rust-sdk
• CWE-290: Authentication Bypass by Spoofing: https://cwe.mitre.org/data/definitions/290.html
• MITRE ATT&CK T1557: Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/
• No known threat actor campaigns or exploit-in-the-wild evidence available at the time of writing. CISA KEV: Not listed.