Which versions of Dendrite are affected by CVE-2026-63095?

Dendrite Matrix homeserver versions through 0.13.8 contain an authorization flaw allowing any authenticated user to delete another user's email or phone number bindings, enabling account hijacking…

Is there a public PoC exploit available for CVE-2026-63095?

Yes, a public proof-of-concept exploit is available for CVE-2026-63095. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-63095?

Within 24 hours, confirm whether Dendrite is deployed in your environment and which version is running; if version 0.13.8 or earlier, assess the scope of access (is Dendrite internally deployed, or exposed to untrusted users?). Within 7 days, implement compensating controls: restrict access to the POST /account/3pid/delete endpoint (firewall rules or reverse-proxy filtering), enable audit logging for all 3PID binding changes, and consider requiring confirmation (e.g., email verification) before 3PID deletion takes effect. Within 30 days, monitor the Dendrite project for a patched version (current release cycle suggests a fix is forthcoming); when available, upgrade to the patched version and validate the fix in a non-production environment first. If no patch timeline emerges, evaluate switching to an alternative Matrix homeserver (Synapse, for example).

Dendrite CVE-2026-63095

Q: What is the CVSS score of CVE-2026-63095?

CVE-2026-63095 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45192 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-17 VulnCheck

GHSA-35h8-2q42-v6f5

Authentication Bypass Dendrite Matrix Org

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint needing any authenticated account (PR:L) with low complexity and no interaction; impact is integrity-only (deleting/altering others' 3PID bindings), no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 16:16 vuln.today

CVE Published

Jul 17, 2026 - 15:27 cve.org

HIGH 7.1

DescriptionCVE.org

Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users by submitting an arbitrary address and medium to the account deletion endpoint without ownership verification. Attackers can exploit the unverified Forget3PID handler to remove a victim's email or MSISDN binding and subsequently rebind the address through an identity server to hijack the victim's password reset flow.

AnalysisAI

Improper authorization in Dendrite (the Go-based Matrix homeserver) through version 0.13.8 lets any authenticated local user delete another user's third-party identifier (3PID) bindings via the POST /account/3pid/delete endpoint, because the Forget3PID handler removes the supplied address/medium without verifying ownership. By stripping a victim's email or MSISDN binding and rebinding it through an identity server, an attacker can hijack the victim's account-recovery/password-reset flow. Publicly available exploit code exists; there is no CISA KEV listing, so this is not confirmed as actively exploited.

Technical ContextAI

Dendrite is Matrix.org's second-generation homeserver implementing the Matrix Client-Server API. Third-party identifiers (3PIDs) are external contact addresses - email addresses (medium 'email') or phone numbers (medium 'msisdn') - bound to a Matrix account and commonly used for account discovery and password reset. The flaw is a classic CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the Forget3PID handler backing POST /_matrix/client/.../account/3pid/delete trusts the attacker-supplied 'address' and 'medium' parameters and deletes the matching binding without checking that the binding actually belongs to the calling user. The affected software is identified by CPE cpe:2.3:a:matrix-org:dendrite:*:*:*:*:*:*:*:* covering all releases up to and including 0.13.8.

RemediationAI

No vendor-released patch version is identified in the available data, so upgrade to a fixed Dendrite release once matrix-org publishes one and monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/dendrite-improper-authorization-via-post-account-3pid-delete-endpoint) and the Dendrite project releases for a version above 0.13.8. As compensating controls until a patch is deployed: restrict or gate the account 3PID management endpoints at a reverse proxy for untrusted local accounts, disable or avoid relying on 3PID/identity-server-based password reset so a stolen binding cannot be leveraged for account recovery (trade-off: users lose email/SMS self-service reset and must use admin-assisted recovery), and tighten local registration to reduce the pool of authenticated accounts able to reach the endpoint. Audit 3PID binding changes in logs to detect unauthorized deletions. Confirm any exact fix version directly with the vendor before assuming remediation - do not rely on inferred version numbers.