CVE-2022-39264: nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which…

PriorityP429medium5.9CVSS 3.1

AVNACHPRNUINSUCNIHAN

EPSS

0.64%

46.6th percentile

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	nheko	< nheko 0.10.2-1 (bookworm)	nheko 0.10.2-1 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
nheko-reborn	nheko	< 0.10.2	0.10.2
nheko-reborn	nheko	>= 0 < 0.10.2-1	0.10.2-1
nheko-reborn	nheko	>= 0 < 0.10.2-1	0.10.2-1
nheko-reborn	nheko	>= 0 < 0.10.2-1	0.10.2-1

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

osv5.9MEDIUM

vendor_debian8.6HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.