Element Call
Monthly
Element Call's standalone SPA build writes the shared call-encryption `password` URL query parameter verbatim into its application logs, and those logs are bundled into error reports ("rageshakes") that are sent to the application operator. The flaw affects versions 0.16.0 through 0.20.2 - deployments such as call.element.io - and is rated moderate severity because disclosure only occurs when a user actively submits a bug report and someone with access to the rageshake log store later reads it; the credentials themselves are never exposed over the network path. Version 0.20.3 adds redaction of the `password` key, and there is no public exploit code identified at time of analysis, though operators running their own rageshake servers must separately purge secrets already captured in historical reports.
Element Call's standalone SPA build writes the shared call-encryption `password` URL query parameter verbatim into its application logs, and those logs are bundled into error reports ("rageshakes") that are sent to the application operator. The flaw affects versions 0.16.0 through 0.20.2 - deployments such as call.element.io - and is rated moderate severity because disclosure only occurs when a user actively submits a bug report and someone with access to the rageshake log store later reads it; the credentials themselves are never exposed over the network path. Version 0.20.3 adds redaction of the `password` key, and there is no public exploit code identified at time of analysis, though operators running their own rageshake servers must separately purge secrets already captured in historical reports.