7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42553

CVE-2026-42553: Cinny: Access token disclosure via invalidated emoji pack avatar URL in service worker

Cinny is a Matrix client. Prior to 4.10.3, A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (for example in a DM) can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for the room containing a malicious emote pack. This is caused by an incorrect fallback in EmojiBoard that uses untrusted pack.meta.avatar (user-controlled) without converting/validating it as an MXC URL, allowing arbitrary HTTP(S) URLs to be used. Also, the service worker attaching the user's Authorization bearer token to all outbound GET requests whose URL contains /_matrix/client/v1/media/download or /_matrix/client/v1/media/thumbnail without verifying the request host matches the configured homeserver origin. An attacker-controlled URL containing those path fragments and permissive CORS will receive the victim's Authorization header (access token). This vulnerability is fixed in 4.10.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42553

CVE-2026-42553:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cinny	npm	< 4.10.3	4.10.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an access token disclosure caused by a chain of two weaknesses. The exploit begins when a user opens the emoji or sticker picker in a room containing a malicious pack created by an attacker.

First, in src/app/components/emoji-board/EmojiBoard.tsx, the EmojiSidebar and StickerSidebar components were responsible for displaying pack avatars. When generating the avatar URL, the code would insecurely fall back to using the raw pack.meta.avatar field if converting the primary mxc:// URL failed. An attacker could abuse this by setting the avatar URL in their malicious pack to a URL on an external server they control.

Second, the application's service worker, defined in src/sw.ts, contained a critical flaw in its fetch event listener. This listener was designed to attach the user's access token to Matrix media requests. However, it only checked if the request URL contained the substrings /_matrix/client/v1/media/download or /_matrix/client/v1/media/thumbnail, without verifying that the request was actually being sent to the user's homeserver.

When a victim's client attempted to render the malicious avatar, it made a request to the attacker's URL. The service worker intercepted this request, saw the trigger substring in the URL, and incorrectly attached the victim's Authorization bearer token to the request, sending it directly to the attacker's server. The patch resolves this by removing the insecure URL fallback in the UI components and adding strict host validation in the service worker.

Vulnerable functions

EmojiSidebar

src/app/components/emoji-board/EmojiBoard.tsx

This React component, responsible for rendering the emoji pack sidebar, constructs the URL for a pack's avatar. The vulnerable version insecurely fell back to using the raw `pack.meta.avatar` URL if the primary `mxcUrlToHttp` conversion failed. Since `pack.meta.avatar` is user-controlled, an attacker could provide a URL to their own server, which is the first step in the exploit chain.

StickerSidebar

src/app/components/emoji-board/EmojiBoard.tsx

This React component, responsible for rendering the sticker pack sidebar, constructs the URL for a pack's avatar. The vulnerable version insecurely fell back to using the raw `pack.meta.avatar` URL if the primary `mxcUrlToHttp` conversion failed. Since `pack.meta.avatar` is user-controlled, an attacker could provide a URL to their own server. This is identical to the vulnerability in `EmojiSidebar` but for stickers.

self.addEventListener('fetch', ...)

src/sw.ts

The service worker's 'fetch' event listener intercepts outgoing requests. The vulnerable version would attach the user's access token to any GET request as long as its URL contained `/_matrix/client/v1/media/download` or `/_matrix/client/v1/media/thumbnail`, without verifying the request's destination host. This allowed the access token to be leaked to an attacker's server when the client requested a malicious avatar URL from `EmojiSidebar` or `StickerSidebar`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.