CVE-2025-62425: Matrix Authentication Service Bypass Flaw

CVE-2025-62425 Overview

CVE-2025-62425 is a logic flaw in Matrix Authentication Service (MAS), a user management and authentication service for Matrix homeservers maintained by Element. Versions 0.20.0 through 1.4.0 fail to require password re-entry before performing sensitive account operations. An attacker holding an authenticated MAS session can change the account password, add or remove email addresses, and deactivate the account without supplying the current password. The flaw only affects deployments that enable the local password database feature in the passwords configuration section. The issue is tracked under CWE-620: Unverified Password Change and was patched in matrix-authentication-service 1.4.1.

Critical Impact
An attacker with a hijacked or borrowed authenticated session can take over a MAS account by resetting the password and email without knowing the original credentials.

Affected Products

Matrix Authentication Service 0.20.0 through 1.4.0
Element-hosted Matrix homeservers using MAS with local password database enabled
Self-hosted Matrix deployments with the passwords configuration section enabled

Discovery Timeline

2025-10-16 - CVE-2025-62425 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-62425

Vulnerability Analysis

The vulnerability is a missing authentication-on-action check in account self-service flows. MAS exposes endpoints to change passwords, manage email addresses, and deactivate accounts. These endpoints rely on session authentication but fail to enforce a step-up password challenge before mutating sensitive account state. Any actor possessing a valid authenticated session token can invoke these operations directly.

The practical consequence is full account takeover from a transient session compromise. An attacker who obtains a session through cross-site scripting, a shared workstation, malware-harvested cookies, or a forgotten logout can pivot to permanent control. Changing the recovery email and password locks out the legitimate user and breaks downstream account recovery paths tied to the homeserver identity.

Root Cause

The root cause is an unverified password change pattern classified as CWE-620. The application treats session authentication as sufficient authorization for high-impact state changes. Sensitive operations should require fresh proof of knowledge of the current credential, but MAS did not implement this re-authentication step for the affected flows prior to version 1.4.1.

Attack Vector

Exploitation requires network access and an authenticated MAS session, but no user interaction beyond that. The attack proceeds in three stages: obtain a valid session cookie or token, issue requests to the password-change or email-management endpoints, then deactivate the original recovery channels. Because the flaw is purely a logic gap, no special tooling is required. Standard HTTP clients reproduce the issue against vulnerable instances. See the GitHub Security Advisory GHSA-6wfp-jq3r-j9xh for vendor details and the upstream commit implementing the fix.

Detection Methods for CVE-2025-62425

Indicators of Compromise

Password change events on MAS accounts that lack a preceding re-authentication or step-up challenge log entry.
Email address additions or removals followed shortly by a password reset from the same session ID.
Account deactivation requests originating from sessions that have been idle or recently resumed from unusual IP addresses.
Multiple sensitive account mutations within a short window from a single session token.

Detection Strategies

Audit MAS application logs for the /account/password, /account/emails, and /account/deactivate (or equivalent) endpoints and correlate against authentication step-up events.
Alert on sequences where password, email, and deactivation changes occur from the same session without a corresponding credential re-prompt.
Compare session source IP and user agent at login time versus the time of sensitive operations to flag session reuse from anomalous contexts.

Monitoring Recommendations

Forward MAS access and audit logs to a centralized SIEM and build detections for back-to-back account self-service mutations.
Track the running MAS version across deployments and alert when any instance reports a version between 0.20.0 and 1.4.0.
Monitor for spikes in account recovery support tickets, which often follow unauthorized email or password changes.

How to Mitigate CVE-2025-62425

Immediate Actions Required

Upgrade matrix-authentication-service to version 1.4.1 or later on all homeserver deployments.
Invalidate all existing MAS sessions after upgrading to force re-authentication and evict any hijacked sessions.
Review recent password, email, and deactivation events for accounts and notify users of any unexpected changes.
Audit the passwords configuration block to confirm whether the local password database feature is active and within scope.

Patch Information

The vendor released matrix-authentication-service 1.4.1 containing the fix. The corrective change is published in the upstream commit bce99ed, which adds the missing re-authentication requirement on sensitive account operations. Full details are documented in GHSA-6wfp-jq3r-j9xh.

Workarounds

If immediate patching is not possible, disable the local password database by removing or disabling the passwords section in the MAS configuration and route authentication through an upstream identity provider.
Shorten session lifetimes and enforce reauthentication on sensitive routes at a reverse proxy layer until the upgrade is applied.
Restrict administrative and account management endpoints to known networks where feasible.

bash

# Upgrade matrix-authentication-service to the patched release
# Example using the official container image
docker pull ghcr.io/element-hq/matrix-authentication-service:1.4.1
docker stop mas && docker rm mas
docker run -d --name mas \
  -v /etc/mas:/config:ro \
  -p 8080:8080 \
  ghcr.io/element-hq/matrix-authentication-service:1.4.1

# Verify the running version
curl -s http://localhost:8080/health | grep version