Conduit Homeserver CVE-2025-68667

The target must be reachable as a federating Matrix homeserver and must be running an affected build (Conduit <0.10.10, continuwuity <0.5.0, tuwunel <1.4.8, or Grapevine before commit 9a50c244); the vulnerable path is the federation endpoint PUT /_matrix/federation/v2/invite/{roomId}/{eventId}, which fails to validate that the request origin matches the event's user. Forging 'leave' events requires no account on the target (the server accepts any federation request whose state_key is a valid local user ID). Forging 'invite' events additionally requires the attacker to control an account on some server that holds the power level to send invites in the room, and forging 'ban' events requires the impersonated victim to hold ban power and the ban target to reside on the same server as the victim (cross-server bans and self-bans are not possible). The documented workaround - blocking the invite endpoint at the reverse proxy - limits only the invite-forging path. Limiting factor: operators who have patched or who are not exposed to open federation are not exploitable.

The CVSS 4.0 base score of 9.9 is driven by a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N/UI:N) with high impact to confidentiality, integrity and availability, plus a subsequent-system confidentiality impact (SC:H) reflecting cross-room/cross-federation effects - this is consistent with the description (a remote attacker coerces the server into signing forged membership events). No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the severity is theoretical-but-credible rather than confirmed in-the-wild. The decisive mitigating factor is deployment footprint: the affected products (Conduit, continuwuity, tuwunel, Grapevine) are niche Matrix homeserver implementations, not the dominant Synapse server, so this is a genuine high priority for the specific operators running these builds but not a broad internet-wide emergency. The SSVC-style read: exploitation=none observed, technical impact=total, automatable=likely yes (unauthenticated federation request), so operators of affected servers should patch urgently while the overall population of exposed hosts is small. Note the input Tags label this 'Denial Of Service' only, which understates the confidentiality and integrity impact (private room history exposure, forged invites/bans) documented in the description - do not treat this as DoS-only.

An attacker operating any Matrix-federating server sends a crafted federation request to a vulnerable homeserver whose event state_key is a valid local user ID; because the server never validates the request origin, it cryptographically signs the forged membership event. The attacker forges a 'leave' to eject an admin/bot from a room (DoS and stripping of policy-server protections), or forges an 'invite' from a victim to themselves to join a private room and read confidential history. No public proof-of-concept was provided in the input.