AIKIDO-2026-598356

TL;DR

For some client requests concerning remote users or rooms belonging to a malicious homeserver, Synapse makes federation requests and forwards the received errors directly back to the client. A malicious homeserver can return an unauthorized error that makes the client believe its own access token is invalid, causing it to log out and destroy its cryptographic state. Users without another client or key backup can irreversibly lose encrypted message history. The fix rewrites forwarded upstream errors and forbids the sensitive token errcode from being relayed.