CVE-2021-40823

CVE-2021-40823 is a logic error in the room key sharing functionality of the Matrix Javascript SDK (matrix-js-sdk) prior to version 12.4.1. This vulnerability allows a malicious Matrix homeserver to steal room encryption keys from affected clients by sending crafted Matrix protocol messages within an encrypted room. This enables the homeserver to decrypt end-to-end encrypted messages sent by those clients. The vulnerability has a CVSS score of 5.9 (Medium), indicating a network-based attack with high complexity, requiring no user interaction, and resulting in high confidentiality impact. While the attack is difficult to execute, a successful exploit would compromise the privacy of encrypted communications. There is no evidence of active exploitation, nor are there any publicly available exploit tools like Metasploit, Nuclei, or ExploitDB entries. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.