CVE-2026-24471 Details
Description
continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room (rejecting an invite), joining a room or knocking on a room, the victim server may ask a remote server for assistance. If the victim asks the attacker server for assistance the attacker is able to provide an arbitrary event, which the victim will sign and return to the attacker. For the /leave endpoint, this works for any event with a supported room version, where the origin and origin_server_ts is set by the victim. For the /join endpoint, an additionally victim-set content field in the format of a join membership is needed. For the /knock endpoint, an additional victim-set content field in the format of a knock membership and a room version not between 1 and 6 is needed. This was exploited as a part of a larger chain against the continuwuity.org homeserver. This vulnerability affects all Conduit-derived servers. This vulnerability is fixed in Continuwuity 0.5.1, Conduit 0.10.11, Grapevine 0aae932b, and Tuwunel 1.4.9.
An improper validation vulnerability has been identified in Continuwuity, a Matrix homeserver written in Rust, and its derivative Conduit. This vulnerability allows an attacker with a malicious remote server to manipulate the local server into signing arbitrary events based on user interactions. The issue arises when a user leaves a room, joins a room, or knocks on a room, as the victim server may request assistance from a remote server. If the victim server engages with the attacker's server, the attacker can inject a custom event that the victim server will sign and return. This exploitation can be tailored to specific endpoints: the leave endpoint can be used to forge valid message and state events for any user on the victim's server, while the join and knock endpoints, although fixed in the latest versions, can still be exploited under certain conditions. This vulnerability affects all Conduit-derived servers and has been exploited against the continuwuity.org homeserver.
Users can update to Continuwuity version 0.5.1 or Conduit version 0.10.11. For Grapevine, version 0aae932b is available, and Tuwunel users should update to version 1.4.9.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 2, 2026CISA-ADP
Assessed Feb 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://forgejo.ellis.link/continuwuation/continuwuity/commit/12aecf809172205436c852a1eaf268c1a2c3a900 | [email protected] | Source CodeVendor |
| https://github.com/continuwuity/continuwuity/security/advisories/GHSA-m5p2-vccg-8c9v | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| continuwuity | All versions |
CPE
Remediation
| |
| Conduit | < 0.10.11 (semver) |
CPE
Remediation
| |
| Grapevine | All versions |
CPE
Remediation
| |
| Tuwunel | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 2, 2026 | New CVE Received | [email protected] |