CVE-2026-42553: Cinny: Access token disclosure via invalidated emoji pack avatar URL in service worker

Synopsis

This is an access token disclosure vulnerability in Cinny, a Matrix web client. A remote attacker who shares a room with a victim and holds room-emote creation permissions can plant a malicious emoji pack avatar pointing to an attacker-controlled URL; when the victim opens the emoji or sticker picker, the Cinny service worker appends the victim's Matrix Authorization bearer token to the outbound request because it matches on path fragments (/_matrix/client/v1/media/download or /_matrix/client/v1/media/thumbnail) without verifying the destination host. Successful exploitation gives the attacker a valid Matrix access token, enabling full account impersonation. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's Cinny instance over the network and must share a Matrix room with the victim to deliver the malicious emoji pack.

• AuthenticationRequired

  The attacker must hold a valid Matrix account with room-emote creation permissions in a shared room; any low-privilege account meeting that criterion is sufficient.

• Victim interactionNot required

  No explicit victim action beyond opening the emoji or sticker picker in the affected room is required; no social-engineering step is needed beyond the attacker being in the same room.

• Attack complexityDetail

  Exploit conditions are reliable and largely free of environmental constraints; the attacker simply sets a crafted avatar URL and waits for the victim to open the picker.

Blast Radius

• The attacker receives the victim's Matrix access token in the Authorization header of the forged request.
• With the stolen token the attacker can impersonate the victim across the entire Matrix homeserver, reading all room history the account can access.
• The attacker can send messages, modify room state, and perform any API action the victim's account is authorized for.