CVE-2026-63095: Dendrite Auth Bypass Vulnerability

CVE-2026-63095 Overview

CVE-2026-63095 is an improper authorization vulnerability in Dendrite, a second-generation Matrix homeserver written in Go. Versions through 0.13.8 fail to verify ownership of third-party identifiers (3PIDs) before deletion in the POST /_matrix/client/r0/account/3pid/delete endpoint. Any authenticated local user can submit an arbitrary address and medium to remove another user's email or MSISDN binding. After unbinding, an attacker can rebind the identifier to their own account through an identity server and hijack the victim's password reset flow. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
An authenticated Matrix user can unbind a victim's email or phone number and take over their account through the password reset flow.

Affected Products

Dendrite Matrix homeserver versions through 0.13.8
Matrix Client-Server API POST /_matrix/client/r0/account/3pid/delete endpoint
Deployments relying on 3PID bindings for password reset workflows

Discovery Timeline

2026-07-17 - CVE-2026-63095 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-63095

Vulnerability Analysis

Dendrite exposes the Matrix Client-Server API endpoint POST /_matrix/client/r0/account/3pid/delete to allow users to remove their own third-party identifier bindings. Third-party identifiers include email addresses and Mobile Station International Subscriber Directory Numbers (MSISDNs) used for account discovery and password recovery. The Forget3PID handler accepts address and medium values from the request body and deletes matching records without checking that the caller owns the identifier being removed.

Because the deletion query keys only on the submitted address and medium, an authenticated attacker can target any other user's binding. Once the binding is removed, the attacker registers the same address on their own account via an identity server. Any subsequent password reset request routed to that address arrives at the attacker's inbox, enabling account takeover.

Root Cause

The root cause is missing ownership verification in the Forget3PID handler. The endpoint trusts user-controlled input as the lookup key for a privileged operation, which matches the classification under CWE-639. No check compares the requesting user's ID against the owner of the 3PID binding before executing the delete.

Attack Vector

Exploitation requires only a valid local account on the target Dendrite homeserver. The attacker sends a crafted POST /_matrix/client/r0/account/3pid/delete request containing the victim's email address or MSISDN and its medium. The server removes the binding and returns success. The attacker then binds the same identifier to their own account and initiates the Matrix password reset flow to receive the recovery token.

The vulnerability mechanism is documented in the GitHub IDOR Analysis and the VulnCheck Security Advisory.

Detection Methods for CVE-2026-63095

Indicators of Compromise

POST /_matrix/client/r0/account/3pid/delete requests where the submitted address does not match any 3PID owned by the authenticated user
Unexpected m.3pid.delete audit events followed by new 3PID bindings from a different Matrix user ID
Password reset tokens issued to email addresses recently rebound to a new account

Detection Strategies

Correlate 3PID deletion events with the authenticated user's known bindings and alert on mismatches
Alert on password reset requests that occur within a short window after a 3PID rebind operation
Review Dendrite access logs for repeated 3pid/delete calls from a single account against multiple addresses

Monitoring Recommendations

Enable verbose logging on Matrix account management endpoints and forward to a centralized log store
Track the relationship between Matrix user IDs and 3PID bindings over time to identify anomalous unbind-rebind sequences
Monitor identity server callbacks for bindings that reassign an address between local accounts

How to Mitigate CVE-2026-63095

Immediate Actions Required

Restrict access to the Dendrite Client-Server API to trusted networks until a patched build is deployed
Audit recent 3PID deletion and rebind events and notify users whose bindings changed without their consent
Temporarily disable password reset via 3PID if an authoritative fix is not yet available

Patch Information

The vulnerability affects Dendrite through version 0.13.8. Operators should track the Dendrite project for a release addressing improper authorization in the Forget3PID handler and upgrade to the fixed version once published. Consult the VulnCheck Security Advisory for the current remediation status.

Workarounds

Deploy a reverse proxy rule that rejects POST /_matrix/client/r0/account/3pid/delete requests until an upstream fix is applied
Enforce administrator-mediated 3PID changes by disabling self-service unbind in front-end clients
Require secondary verification, such as a confirmation email to the current binding, before honoring any 3PID delete request

bash

# Example nginx rule to block the vulnerable endpoint at the edge
location ~ ^/_matrix/client/r0/account/3pid/delete$ {
    return 403;
}