Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Matrix SDK Exposes Access Tokens in Application Logs
published 4 years ago
Summary
Using the Matrix SDK with a certain logging setup may leak user access tokens in logs. This is a security concern because an attacker with access to these logs could potentially use the exposed token to impersonate the user and access their account. To protect user data, update the logging configuration to exclude sensitive information or use a different logging library that doesn't expose access tokens.
What to do
- Update poljar matrix-sdk to version 0.6.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | poljar | matrix-sdk |
>= 0.6.0, < 0.6.2 Fix: upgrade to 0.6.2
|
Original advisory text
matrix-sdk 0.6.0 logs access tokens
When sending Matrix requests using an affected version of `matrix-sdk` in an application that writes logs using `tracing-subscriber` (in a way that includes fields of tracing spans such as `tracing_subscriber`s default text output from the `fmt` module), these logs will contain the user's access token.
Timeline
Published25 Oct 2022
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-fc4h-xcf3-qj5f · GHSA
Track software like this
Free during beta