matrix-sdk-crypto CVE-2026-45056

The Matrix protocol uses the Olm cryptographic ratchet for encrypted to-device messages, which are direct device-to-device communications outside of room context. The matrix-sdk-crypto crate (pkg:rust/matrix-sdk-crypto) implements this layer in the Matrix Rust SDK. When decrypting an incoming Olm to-device message, the crate processes an optional sender_device_keys property embedded in the plaintext payload. Prior to 0.16.1, the code failed to verify that the user_id field within sender_device_keys matched the authenticated sender identity established by the Olm session itself. CWE-290 (Authentication Bypass by Spoofing) precisely describes this root cause: a trusted identity claim is accepted without binding it to the channel-verified identity. The PR diff confirms the fix adds explicit validation rejecting messages where the embedded sender_device_keys.user_id does not match the Olm session's sender, and also tightens checks for unsigned device keys and mismatched Ed25519 keys.