-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-synapse | pip | < 1.5.0 | 1.5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing signature verification (_check_sigs_and_hash) and origin validation (sender domain vs request origin) in key federation API handlers. The patch added: 1) _check_sigs_and_hash calls in FederationServer's invite/join/leave handlers to verify cryptographic signatures, and 2) sender-origin matching checks in FederationHandler's join/leave handlers. The absence of these checks in pre-1.5.0 versions made the listed functions vulnerable to accepting improperly signed events or events from unexpected servers.
PythonPythonKEV Misses 88% of Exploited CVEs- Get the report