| Package | Affected versions | Patched versions |
|---|---|---|
| matrix-synapse | < 0.34.0.1 | 0.34.0.1 |
| synapse | < 0.34.0.1 | 0.34.0.1 |
Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free