CVE-2025-68667

published 2025-12-23

CVE-2025-68667: Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to…

Priority P2 65 critical 9.9 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC H SI L SA L E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10, continuwuity prior to version 0.5.0, Grapevine prior to commit `9a50c244`, and tuwunel prior to version 1.4.8. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. Attackers can forge "leave" events for any user on the target server. This forcibly removes users (including admins and bots) from rooms. This allows denial of service and/or the removal of technical protections for a room (including policy servers, if all users on the policy server are removed). Attackers can forge "invite" events from a victim user to themselves, provided they have an account on a server where there is an account that has the power level to send invites. This allows the attacker to join private or invite-only rooms accessible by the victim, exposing confidential conversation history and room state. Attackers can forge "ban" events from a victim user to any user below the victim user's power level, provided the victim has the power level to issue bans AND the target of the ban resides on the same server as the victim. This allows the attacker to ban anyone in a room who is on the same server as the vulnerable one, however cannot exploit this to ban users on other servers or the victim themself. Conduit fixes the issue in version 0.10.10. continuwuity fixes the issue in commits `7fa4fa98` and `b2bead67`, released in 0.5.0. tuwunel fixes the issue in commit `dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3`, released in 1.4.8. Grapevine fixes the issue in commit `9a50c2448abba6e2b7d79c64243bb438b351616c`. As a workaround, block access to the `PUT /_matrix/federation/v2/invite/{roomId}/{eventId

Affected

1 ranges

Vendor	Product	Version range	Fixed in
continuwuity	continuwuity	< 0.5.0	0.5.0

Detection & IOCs extracted from sources · hover to see the quote

url PUT /_matrix/federation/v2/invite/{roomId}/{eventId}↗

hash 7fa4fa98↗

hash b2bead67↗

hash dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3↗

hash 9a50c2448abba6e2b7d79c64243bb438b351616c↗

• → Monitor for unexpected or unauthenticated PUT requests to the Matrix federation invite endpoint `/_matrix/federation/v2/invite/{roomId}/{eventId}` — this is the attack surface exploited by CVE-2025-68667. ↗
• → Alert on mass or unexpected 'leave' membership events originating from federation for local users, especially admins and bots, which may indicate forced removal exploitation. ↗
• → Alert on unexpected 'invite' events sent by local victim users to unknown remote accounts, which may indicate an attacker forging invites to gain access to private rooms. ↗
• → Alert on unexpected 'ban' events issued by local users against other local users, which may indicate forged ban events being injected via federation. ↗
• → The root cause is failure to validate the origin of a signing request when the event's state_key is a valid local user ID — look for signing requests where the requesting origin does not match the server owning the state_key. ↗

• · Affected versions: Conduit < 0.10.10, continuwuity < 0.5.0, tuwunel < 1.4.8, and Grapevine prior to commit 9a50c244. Patch or block the federation invite endpoint immediately. ↗
• · The workaround (blocking the federation invite endpoint at the reverse proxy) will prevent exploitation but will also disable legitimate Matrix federation invite functionality for the server. ↗
• · The Fedora 'catalyst' package references a different, unrelated 'conduit' (an HPC data exchange library by LLNL) and is NOT affected by this CVE. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20 CWE-441