CVE-2025-54315 Overview
CVE-2025-54315 affects the Matrix communication protocol specification before version 1.16. The flaw stems from missing create event uniqueness in room versions prior to 12. Matrix rooms rely on a m.room.create event as the authoritative root of the room's state graph. Without uniqueness enforcement, malicious or malformed federated events can collide with or override the original create event. This weakness maps to [CWE-837] (Improper Enforcement of a Single, Unique Action). The Matrix.org Foundation addressed the issue through the Project Hydra state resolution improvements shipped in specification v1.16.
Critical Impact
Attackers with low-privileged room access can compromise room integrity by exploiting non-unique create events to manipulate state resolution across federated homeservers.
Affected Products
- Matrix specification versions before 1.16
- Matrix rooms using room versions before 12
- Homeserver implementations following the pre-1.16 Matrix specification
Discovery Timeline
- 2025-10-02 - CVE-2025-54315 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-54315
Vulnerability Analysis
Matrix is a decentralized communication protocol where rooms are replicated across federated homeservers. Each room originates from a single m.room.create event that anchors the directed acyclic graph (DAG) of room state. The specification before version 1.16 does not guarantee that this create event is unique within a room's event graph. An attacker who can send federated events into a room can introduce a second create event. State resolution algorithms in pre-version-12 room versions then process multiple create events, leading to inconsistent state across servers.
This inconsistency allows an actor to influence room authority, including power levels, membership, and history visibility, by manipulating which create event wins state resolution on a given homeserver.
Root Cause
The root cause is the absence of a uniqueness constraint on create events in the state resolution algorithm. The protocol implicitly assumed a single create event per room without enforcing the invariant. State resolution code paths did not reject or deduplicate additional create events received over federation, allowing duplicates to participate in authority chains.
Attack Vector
Exploitation requires network-level access to the Matrix federation and low-privilege membership or send capability in a target room. The attacker crafts federated events that introduce or reference an alternate create event. Because federation traffic flows between homeservers without a centralized validator, divergent state can propagate across the network. The attack complexity is high because it depends on the federation topology and state resolution outcomes on receiving servers.
No verified public exploitation code is available. Technical context is documented in the Matrix Blog Post on Project Hydra and the GitHub Release v1.16.
Detection Methods for CVE-2025-54315
Indicators of Compromise
- Presence of more than one m.room.create event referenced in a single room's event DAG.
- State resolution divergence between federated homeservers for the same room ID.
- Unexpected changes to room power levels or ownership that cannot be traced to a legitimate administrative event.
Detection Strategies
- Audit homeserver databases for rooms containing duplicate create events using server-side queries against the events table.
- Compare room state snapshots across federated peers to identify resolution mismatches.
- Enable verbose federation logging and inspect inbound persistent data unit (PDU) streams for create event types arriving after room initialization.
Monitoring Recommendations
- Monitor federation ingress for m.room.create PDUs targeting rooms older than the local server's view of their creation time.
- Alert on power level or membership changes whose auth chain references an unfamiliar create event ID.
- Track room version distribution across the deployment and prioritize remediation of rooms using versions below 12.
How to Mitigate CVE-2025-54315
Immediate Actions Required
- Upgrade homeserver software to releases that implement the Matrix specification v1.16 and support room version 12.
- Create new rooms using room version 12 or later, which enforces create event uniqueness at the protocol level.
- Identify high-value rooms still on legacy room versions and plan upgrades or replacements through the standard room upgrade mechanism.
Patch Information
The Matrix.org Foundation published specification v1.16 introducing room version 12 with create event uniqueness as part of the Project Hydra state resolution rework. Refer to the GitHub Release v1.16 for the normative specification text and to the Matrix Blog Post on Project Hydra for design rationale. Homeserver operators must install vendor updates that implement these specification changes.
Workarounds
- Restrict federation with untrusted homeservers using server access control lists until upgrades are complete.
- Reduce the number of users with event-sending privileges in sensitive rooms running legacy room versions.
- Replace critical legacy rooms with newly created rooms on room version 12 and archive the originals.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
