-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-nio | pip | < 0.20 | 0.20 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the _handle_forwarded_room_key_event function's lack of sender device validation. The commit diff shows the fix introduced a new _should_accept_forward method that adds three critical checks: 1) device exists in store, 2) device is verified, and 3) device belongs to the current user. The original vulnerable version lacked these checks, allowing any device (even untrusted or malicious) to fulfill key requests as long as they had a matching session ID.
PythonPythonKEV Misses 88% of Exploited CVEs- Get the report