CVE-2026-42553: Cinny Matrix Client Token Disclosure Flaw

CVE-2026-42553 Overview

Cinny, a web-based Matrix client, contains an input validation flaw that leaks the victim's Matrix access token to an attacker-controlled server. A remote authenticated attacker who shares a room with the victim and holds permission to create room emotes can weaponize a malicious emote pack. When the victim opens the emoji or sticker picker, the client's service worker attaches the user's Authorization bearer token to an outbound request directed at an arbitrary host. The issue is tracked as [CWE-20] Improper Input Validation and is fixed in Cinny 4.10.3.

Critical Impact
Theft of a Matrix access token grants the attacker full account takeover, allowing them to read, send, and delete messages as the victim across all joined rooms.

Affected Products

Cinny Matrix client versions prior to 4.10.3
Self-hosted and public Cinny web deployments
Any Matrix homeserver users interacting via vulnerable Cinny builds

Discovery Timeline

2026-05-27 - CVE-2026-42553 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-42553

Vulnerability Analysis

The vulnerability combines two improper input validation defects in Cinny's client and its service worker. The EmojiBoard component renders emote pack metadata, including pack.meta.avatar, which is user-controlled. Cinny falls back to this value without verifying that it is a Matrix Content (MXC) URL, accepting arbitrary http(s):// URLs as image sources.

Separately, Cinny's service worker intercepts outbound GET requests and attaches the user's Authorization: Bearer <access_token> header whenever the URL path contains /_matrix/client/v1/media/download or /_matrix/client/v1/media/thumbnail. The service worker does not verify that the request host matches the configured homeserver origin. An attacker controlling a server with permissive CORS and a path containing those fragments receives the victim's access token directly.

Root Cause

The root cause is missing origin and scheme validation. Cinny treats pack.meta.avatar as a trusted MXC reference but never enforces the mxc:// scheme or converts it through the homeserver's media API. The service worker's URL match relies on substring inspection of the path rather than full origin equality against the homeserver.

Attack Vector

The attacker joins or creates a shared room such as a direct message, then publishes an emote pack whose avatar field points to a URL like https://attacker.example/_matrix/client/v1/media/download/x. When the victim opens the emoji or sticker picker, the browser issues a GET for that URL. The service worker matches the path fragment and attaches the bearer token. The attacker's server logs the Authorization header and reuses the token to impersonate the victim against their homeserver.

See the GitHub Security Advisory GHSA-j944-w549-3453 for additional technical context.

Detection Methods for CVE-2026-42553

Indicators of Compromise

Outbound requests from Cinny clients to hosts other than the configured homeserver that include /_matrix/client/v1/media/download or /_matrix/client/v1/media/thumbnail in the path.
Emote pack state events containing an avatar field that begins with http:// or https:// rather than mxc://.
Matrix homeserver audit logs showing access token reuse from unexpected IP addresses or user agents shortly after a user opens an emoji picker.

Detection Strategies

Inspect browser network telemetry for cross-origin GET requests carrying an Authorization: Bearer header destined to non-homeserver domains.
Hunt across Matrix room state for im.ponies.room_emotes or pack events with non-MXC avatar URLs and flag the senders.
Correlate sudden geographic or device shifts on Matrix accounts with recent membership in low-trust rooms.

Monitoring Recommendations

Enable homeserver-side logging of /_matrix/client/v3/account/whoami and message-send endpoints, alerting on token use from new client fingerprints.
Monitor egress proxy logs for Cinny user agents contacting hosts outside the approved homeserver allow-list.
Track Cinny client build versions reported in User-Agent headers and alert on versions earlier than 4.10.3.

How to Mitigate CVE-2026-42553

Immediate Actions Required

Upgrade all Cinny deployments to version 4.10.3 or later without delay.
Invalidate active Matrix access tokens for users who used vulnerable Cinny builds in untrusted rooms, forcing re-authentication.
Audit emote packs in shared and direct-message rooms for non-MXC avatar URLs and remove suspicious packs.

Patch Information

The fix is published in the Cinny v4.10.3 release. The patch validates that pack.meta.avatar resolves through the MXC conversion path and constrains the service worker's Authorization header attachment to requests whose origin matches the configured homeserver.

Workarounds

Restrict emote creation permissions in shared rooms to trusted moderators only by raising the required power level.
Avoid opening the emoji or sticker picker in rooms shared with untrusted users until the upgrade is applied.
Deploy a reverse proxy or browser extension that strips Authorization headers from requests directed to non-homeserver origins.

bash

# Upgrade Cinny to the patched release
git clone https://github.com/cinnyapp/cinny.git
cd cinny
git checkout v4.10.3
npm install
npm run build