CVE-2022-39264

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287 CWE-295

Affected software

Vendor	Product	Versions
Nheko-Reborn	nheko	< 0.10.2

References

Timeline

Published: Sep 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392657.2MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting CVE-2022-392669.8isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 CVE-2022-392678.8Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for productio CVE-2022-392688.1### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may CVE-2022-392699.1PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch CVE-2022-39279.8The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification.CVE-2022-392705.4DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categorie CVE-2022-392717.5Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential CVE-2022-392724.3Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Use CVE-2022-392737.5FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without ch CVE-2022-392749.8LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable CVE-2022-392754.3Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input wh