Skip to content
Threat Feed

Product

Cinny

1 brief RSS
high advisory

Cinny Access Token Disclosure via Malicious Emoji Pack

A remote authenticated attacker who shares a room with a victim can steal their Matrix access token by injecting a malicious emote pack, exploiting improper URL validation and service worker behavior in Cinny versions prior to 4.10.3.

cinny credential-access web-application token-theft
3r 1t