continuwuity vulnerabilities

Products

• continuwuity 2

Latest continuwuity CVEs

Newest publication first

1. CVE-2026-24471 Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')

   Published 2026-02-02

   Critical·CVSS 9.3 EPSS 0.35%

   continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room (rejecting an invite), joining a room or knocki...

2. CVE-2025-68667 Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue

   Published 2025-12-23

   Critical·CVSS 9.9 EPSS 0.59%

   Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.