PT-2025-52860 · Unknown · Continuwuity

Jadedblueeyes · Published 2025-12-23 · Updated 2025-12-26 · CVE-2025-68667

Positive Technologies (AI Summary)

CVSS v4.0

9.9

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions continuwuity versions prior to 0.5.0

Description A remote, unauthenticated attacker can force the target server to cryptographically sign arbitrary membership events. This occurs because the server does not validate the origin of a signing request when the event's state key is a valid user ID belonging to the target server. The vulnerable API endpoint is / matrix/federation/v2/invite/{roomId}/{eventId}.

Recommendations Block access to the PUT / matrix/federation/v2/invite/{roomId}/{eventId} endpoint using a reverse proxy. Update to version 0.5.0 or later.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

CWE-441

Related Identifiers

CVE-2025-68667

GHSA-22FW-4JQ7-G8R8

Affected Products

Continuwuity

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68667.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-68667 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68667 · Security Note
• https://github.com/matrix-construct/tuwunel/commit/dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3 · Note
• https://github.com/continuwuity/continuwuity/security/advisories/GHSA-22fw-4jq7-g8r8 · Note
• https://twitter.com/CVEnew/status/2003700503193190695 · Twitter Post
• https://t.me/cveNotify/146916 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2003634005594226742 · Twitter Post
• https://forgejo.ellis.link/continuwuation/continuwuity/commit/b2bead67ac8bc45de9a612578f295e5b7fc6c2b5 · Note
• https://gitlab.com/famedly/conduit/-/releases/v0.10.10 · Note
• https://gitlab.computer.surgery/matrix/grapevine/-/commit/9a50c2448abba6e2b7d79c64243bb438b351616c · Note
• https://twitter.com/0dayPublishing/status/2003600414755770571 · Twitter Post
• https://t.me/CVEtracker/40540 · Telegram Post
• https://forgejo.ellis.link/continuwuation/continuwuity/commit/7fa4fa98628593c1a963f5aa8dbc3657d604b047 · Note