CVE-2021-32659

CVE-2021-32659 affects Matrix-appservice-bridge versions 2.6.0 and earlier, allowing a malicious administrator of a bridged room to redirect traffic to an arbitrary room without the new room's awareness. This occurs when room upgrade handling is enabled, as the bridge fails to verify the predecessor field in the target room's m.room.create event. Rated as Medium severity (CVSS 4.9), the vulnerability has a network attack vector, low attack complexity, and high impact on integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.