Synapse's invalid device keys degrade federation functionality
GHSA-fh66-fcv5-jjfr · CVE-2025-61672 · PYSEC-2026-1612
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers.
Patches
Patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2.
Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, it is recommend to skip these releases and upgrading straight to 1.138.4 and 1.139.2.
Workarounds
The vulnerability can only be exploited by users registered on the victim homeserver.
References
- WEB https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-61672
- WEB https://github.com/element-hq/synapse/pull/17097
- WEB https://github.com/element-hq/synapse/commit/26aaaf9e48fff80cf67a20c691c75d670034b3c1
- WEB https://github.com/element-hq/synapse/commit/7069636c2d6d1ef2022287addf3ed8b919ef2740
- PACKAGE https://github.com/element-hq/synapse
- WEB https://github.com/element-hq/synapse/releases/tag/v1.138.3
- WEB https://github.com/element-hq/synapse/releases/tag/v1.138.4
- WEB https://github.com/element-hq/synapse/releases/tag/v1.139.1
- WEB https://github.com/element-hq/synapse/releases/tag/v1.139.2
Ready to move
Start Securing
Free, no credit card | First findings in minutes