Every CVE Search/ Get API key

CVE-2021-21332

Cross-site scripting (XSS) vulnerability in the password reset endpoint

6.9 MediumFix available

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

1.22%Up 0.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.9

Cross-site scripting (XSS) vulnerability in the password reset endpoint

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.

Record
CVE-2021-21332
CVSS 3.1
6.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2021-0125 6.9

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.

Record
EUVD-2021-0125
CVSS 3.1
6.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-246w-56m2-5899 5.1

Cross-site scripting (XSS) vulnerability in the password reset endpoint

Impact

The password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

Patches

This is fixed in #9200.

Workarounds

Depending on the needs and configuration of the homeserver a few options are available:

  1. Password resets can be disabled by delegating email to a third-party service (via the account_threepid_delegates.email setting) or disabling email (by not configuring the email setting).

  2. If the homeserver is not configured to use passwords (via the password_config.enabled setting) then the affected endpoint can be blocked at a reverse proxy:

    • /_synapse/client/password_reset/email/submit_token

  3. The password_reset_confirmation.html template can be overridden with a custom template that manually escapes the variables using JInja2's escape filter. See the email.template_dir setting.

Record
GHSA-246w-56m2-5899
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
CVSS 3.1
6.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 6.9

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.

Record
CVE-2021-21332
CVSS 3.1
6.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 8.2

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.

Record
CVE-2021-21332
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-21332 8.2

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.

Record
DEBIAN-CVE-2021-21332
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVGHSA-246w-56m2-5899 5.1

Cross-site scripting (XSS) vulnerability in the password reset endpoint

Impact

The password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

Patches

This is fixed in #9200.

Workarounds

Depending on the needs and configuration of the homeserver a few options are available:

  1. Password resets can be disabled by delegating email to a third-party service (via the account_threepid_delegates.email setting) or disabling email (by not configuring the email setting).

  2. If the homeserver is not configured to use passwords (via the password_config.enabled setting) then the affected endpoint can be blocked at a reverse proxy:

    • /_synapse/client/password_reset/email/submit_token

  3. The password_reset_confirmation.html template can be overridden with a custom template that manually escapes the variables using JInja2's escape filter. See the email.template_dir setting.

Record
GHSA-246w-56m2-5899
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
CVSS 3.1
6.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2021-21332 6.9

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.

Record
UBUNTU-CVE-2021-21332
CVSS 3.1
6.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVPYSEC-2021-133 No score

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.

Record
PYSEC-2021-133
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
matrix-synapse
PyPI
 before 1.27.0
1.27.0
matrix-synapse
PyPI
 before 1.27.0, plus listed versions
0.33.50.33.5.10.33.60.33.6rc10.33.7
Show 45 moreShow less
0.33.7rc10.33.7rc20.33.80.33.8rc20.33.90.34.00.34.0.10.34.0rc10.34.0rc20.34.1.10.99.00.99.0rc10.99.0rc20.99.0rc30.99.0rc40.99.10.99.1.10.99.1rc10.99.1rc20.99.20.99.2rc10.99.30.99.3.10.99.3.20.99.3rc10.99.40.99.4rc10.99.50.99.5.10.99.5.20.99.5rc11.0.01.0.0rc11.0.0rc21.0.0rc31.1.01.1.0rc11.1.0rc21.10.01.10.0rc11.10.0rc21.10.0rc31.10.0rc51.10.11.11.0
1.27.0
matrix-synapse
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.19.2+dfsg-60.24.0+dfsg-10.24.0+dfsg-1ubuntu0.1~esm10.24.0+dfsg-1ubuntu0.1~esm4
 None known
matrix-synapse
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.3.0-11.4.0-11.5.0-11.5.1-11.6.0-1
Show 12 moreShow less
1.6.1-11.7.0-21.7.1-11.7.2-11.7.3-11.8.0-11.9.0-11.9.1-11.10.0-11.10.0-21.11.0-11.11.0-1ubuntu0.1~esm2
 None known

History

History
RecordedChangedSources
affected
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21332 is a medium vulnerability (CVSS 6.9) in Element-hq Synapse, published March 26, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. Fixed in matrix-synapse 1.27.0.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: 99 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open