PyPI/matrix-synapse CVE-2020-26891: medium 6.1, EPSS 1.92%

Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint

Action: Upgrade matrix-synapse to 1.21.0 or later.

pip install matrix-synapse==1.21.0

Affected

Fixed versions

Sources

• osv: GHSA-3x8c-fmpc-5rmq
• https://github.com/matrix-org/synapse/security/advisories/GHSA-3x8c-fmpc-5rmq
• https://nvd.nist.gov/vuln/detail/CVE-2020-26891
• https://github.com/matrix-org/synapse/pull/8444
• https://github.com/matrix-org/synapse
• https://github.com/matrix-org/synapse/releases
• https://github.com/matrix-org/synapse/releases/tag/v1.21.2
• https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2020-238.yaml
• https://matrix.org/blog/2020/10/15/synapse-1-21-2-released-and-security-advisory

CVE-2020-26891 · published 2020-10-16T16:56:04Z · modified 2026-07-08T06:30:00.309784796Z · JSON