CVE-2022-39264 in nheko
Summary
by MITRE • 09/29/2022
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/28/2026
The vulnerability identified as CVE-2022-39264 affects nheko, a popular desktop client for the Matrix communication protocol, specifically targeting versions prior to 0.10.2. This issue represents a critical security flaw that undermines the integrity of end-to-end encrypted communications by enabling malicious actors to manipulate the verification process during device setup. The vulnerability stems from insufficient validation of homeserver responses during the device verification workflow, creating a window where attackers can inject malicious secrets that appear legitimate to the client application. The Matrix protocol relies heavily on device verification to establish trust between participants, making this vulnerability particularly dangerous as it directly compromises the fundamental security assumptions of the communication system.
The technical implementation flaw manifests in how nheko processes verification requests and handles device key exchanges with homeservers. When users attempt to verify their devices or establish trust with other participants, the client does not adequately validate the authenticity of responses received from the homeserver. This weakness allows an attacker who controls or compromises the homeserver to return falsified verification data that includes malicious secrets or altered key information. The vulnerability operates at the intersection of cryptographic protocol implementation and client-side validation, creating a scenario where legitimate verification workflows can be subverted without the user's knowledge. This issue aligns with CWE-295, which addresses improper certificate validation, and reflects the broader category of trust management failures in cryptographic systems.
The operational impact of CVE-2022-39264 extends beyond simple data interception to potentially enable full man-in-the-middle attacks within Matrix conversations. When exploited, this vulnerability allows attackers to impersonate legitimate users, decrypt messages intended for other participants, or inject malicious content into conversations. The risk is particularly elevated for users who rely on Matrix for sensitive communications, as the vulnerability can undermine the security guarantees that end-to-end encryption is designed to provide. Attackers can exploit this weakness to gain unauthorized access to private conversations, potentially leading to data breaches, social engineering attacks, or the compromise of sensitive information shared through the Matrix network. The vulnerability affects all users who have not upgraded to nheko version 0.10.2, making it a widespread concern for the Matrix community.
Organizations and individuals using nheko should immediately upgrade to version 0.10.2 to mitigate this vulnerability, as this release includes patches that strengthen homeserver response validation and improve device verification procedures. The workaround recommendations provided in the advisory offer temporary protection measures but are not sufficient long-term solutions. Users who cannot immediately upgrade should avoid pressing the request button in the settings menu and refrain from manually verifying devices without additional security checks. The recommended mitigation strategy aligns with ATT&CK technique T1557.001, which covers "Adversary-in-the-Middle" attacks, by emphasizing the importance of maintaining secure communication channels and proper verification procedures. Security practitioners should also consider implementing network monitoring to detect potential exploitation attempts and ensure that all Matrix clients within their environment are properly updated to prevent exploitation of this vulnerability.