Every CVE Search/ Get API key

CVE-2022-39264

nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver

8.6 HighFix available

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.82%Down 0.1 points since Sep 29, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.6

nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.

Record
CVE-2022-39264
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-295, CWE-287
Updated
2026-11-02
EUVDEUVD-2022-41773 8.6

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.

Record
EUVD-2022-41773
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
NVD 8.6

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.

Record
CVE-2022-39264
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-287, CWE-295
Updated
2026-11-02
OSVALPINE-CVE-2022-39264 5.9

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.

Record
ALPINE-CVE-2022-39264
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 8.6

nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.

Record
CVE-2022-39264
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-287, CWE-295
Updated
2026-11-02
OSVDEBIAN-CVE-2022-39264 5.9

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.

Record
DEBIAN-CVE-2022-39264
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSVUBUNTU-CVE-2022-39264 8.6

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.

Record
UBUNTU-CVE-2022-39264
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nheko
Alpine:v3.16
before 0.9.3-r2
0.9.3-r2
nheko
Debian:12
before 0.10.2-1
0.10.2-1
nheko
Debian:13
before 0.10.2-1
0.10.2-1
nheko
Debian:14
before 0.10.2-1
0.10.2-1
nheko
Ubuntu:18.04:LTS
All versions, plus listed versions
0.0+git20171116.21fdb26-10.0+git20171116.21fdb26-2
None known
nheko
Ubuntu:20.04:LTS
All versions, plus listed versions
0.6.4-20.6.4-2build10.6.4-2build2
None known
nheko
Ubuntu:22.04:LTS
All versions, plus listed versions
0.8.0+really0.7.2-40.8.2-2build10.9.0-10.9.0-1build10.9.1-1
None known
nheko
Ubuntu:24.04:LTS
All versions, plus listed versions
0.11.3-2build10.11.3-2build20.11.3-2.10.11.3-2.1build10.11.3+~0.9.2+~1.0.0+~0.3.0-1build30.11.3+~0.9.2+~1.0.0+~0.3.0-1build4
None known
nheko
Ubuntu:25.10
All versions, plus listed versions
0.12.0+~0.10.0+~1.0.0+~0.3.1-4build20.12.0+~0.10.0+~1.0.0+~0.3.1-4build30.12.1+~0.10.1+~1.0.0+~0.3.1-10.12.1+~0.10.1+~1.0.0+~0.3.1-1build10.12.1+~0.10.1+~1.0.0+~0.3.1-2
None known
nheko
Ubuntu:26.10
All versions, plus listed versions
0.12.1+~0.10.1+~1.0.0+~0.3.1-4ubuntu30.12.1-1+ds+~0.10.1+ds+~1.0.0+ds+~0.3.2+ds-1build30.12.1-1+ds+~0.10.1+ds+~1.0.0+ds+~0.3.2+ds-1build4
None known
nheko
Ubuntu:26.04:LTS
All versions, plus listed versions
0.12.1+~0.10.1+~1.0.0+~0.3.1-20.12.1+~0.10.1+~1.0.0+~0.3.1-4ubuntu3
None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-39264 is a high vulnerability (CVSS 8.6) in Nheko-reborn Nheko, published September 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in nheko 0.9.3-r2.

References

Show 5 moreShow less
MoveEnter Open