CVE-2026-24471

When a user performs a room leave operation (rejects an invitation), joins a room, or knocks on a room, the victim server may contact a remote server for assistance in performing this operation (endpoints /leave, /join, /knock). If the victim server contacts the attacker's malicious server, the attacker can provide any event that the victim server will sign and return to the attacker. For the /leave endpoint, any event with a supported room version is sufficient, and the origin and origin_server_ts fields are set by the victim server. The /join and /knock endpoints additionally require the presence of a content field in the appropriate membership card format, and /knock additionally requires a room version outside the range 1-6.

An attacker can obtain events signed with the victim server's cryptographic key, allowing for forgery and injection of arbitrary events into the federated Matrix network under the identity of the compromised server. The vulnerability was exploited as part of a broader attack chain on the continuwuity.org server.

Update to: Continuwuity 0.5.1, Conduit 0.10.11, Grapevine commit 0aae932b or Tuwunel 1.4.9. Details available in the GHSA-m5p2-vccg-8c9v security advisory and the fix commit 12aecf809172205436c852a1eaf268c1a2c3a900.

All servers derived from Conduit: continuwuity before version 0.5.1, Conduit before version 0.10.11, Grapevine before commit 0aae932b, and Tuwunel before version 1.4.9.