CVE-2019-5885

—

CVSS 3.0

7.5 high

EPSS

2%p83

Published

Mar 21, 2019 (Mar 21, 2019)

Modified

Jun 17, 2026

Description

Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.

Vendors: matrix fedoraproject
Products: synapse, fedora
Weakness: CWE-330
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (2.4%)

In the news0 stories

No ingested article mentions this CVE yet.