To be clear, the vulnerability was with the specific server configuration for the French Matrix deployment (authing people based on email domain), and not a fla

To be clear, the vulnerability was with the specific server configuration for the French Matrix deployment (authing people based on email domain), and not a flaw in Matrix itself. We're not aware of anyone else running in that config. https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2 https://matrix.org/blog/2019/04/18/security-update-sydent-1-... had the details. The actual bug was thanks to a long-standing bug in python's standard email.utils library, which finally got fixed: https://bugs.python.org/issue34155 https://bugs.python.org/issue34155, combined with insufficiently-defensive coding and testing on my side. (I wrote the auth code in question).