Vulnerability details

CVE-2025-62425

element-hq matrix-authentication-service

Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password

CVSS 3.1

8.3High

Official description

MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. A logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 allows an attacker with access to an authenticated MAS session to perform sensitive operations without entering the current password. These include changing the current password, adding or removing an e-mail address and deactivating the account. The vulnerability only affects instances which have the local password database feature enabled (passwords section in the config). Patched in matrix-authentication-service 1.4.1.

CVSS scores

Score	Version	Source	Vector
8.3High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
element-hq	matrix-authentication-service	>= 0.20.0, <= 1.4.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/element-hq/matrix-authentication-service/security/advisories/GHSA-6wfp-jq3r-j9xh x_refsource_CONFIRM
https://github.com/element-hq/matrix-authentication-service/commit/bce99edb6177be11f8f38c1d01f5606ce7b4b2e5 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-10-16
Last updated: 2025-10-16
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.45%

Probability of exploitation in 30 days

40%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-620
Unverified Password Change