CVE-2023-38691

npm/matrix-appservice-bridge CVE-2023-38691: medium 5, EPSS 0.47%

matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs

Action: Upgrade matrix-appservice-bridge to 8.1.2 or later.

npm i matrix-appservice-bridge@8.1.2

npm i matrix-appservice-bridge@9.0.1

Affected

Fixed versions

Sources

• osv: GHSA-vc7j-h8xg-fv5x
• https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-vc7j-h8xg-fv5x
• https://nvd.nist.gov/vuln/detail/CVE-2023-38691
• https://github.com/matrix-org/matrix-appservice-bridge/commit/4c6723a5e7beda65cdf1ae5dbb882e8beaac8552
• https://github.com/matrix-org/matrix-appservice-bridge

CVE-2023-38691 · published 2023-08-04T17:26:32Z · modified 2026-09-10T03:49:57.718797886Z · JSON