CVE-2023-38691

matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library...

matrix-appservice-irc (=0.36.0) potentially affected by CVE-2023-38691 via matrix-appservice-bridge (=6.0.0)

matrix-appservice-bridge NPM version =6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on matrix-appservice-bridge and may be impacted: - matrix-appservice-irc =0.36.0 Source cves: CVE-2023-38691 Source advisory: OSV:GHSA-VC7J-H8XG-FV5X...

CVE-2023-38691 matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs

matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library...

CVE-2023-38691 matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs

matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library...