Threats tagged 'ghsa-fm3q-8qwm-p5xr'

Element Web and Element Desktop versions before 1.12.32 have a vulnerability where guest credentials passed via URL fragment parameters in the loadSession function can be accepted. This allows remote unauthenticated attackers to log out users and clear local storage, potentially destroying unbacked end-to-end encryption keys by forcing an attacker-controlled guest session.