matrix-org/matrix-rust-sdk · Security
matrix-sdk 0.6.0 logs access tokens
- GHSA ID
- GHSA-fc4h-xcf3-qj5f
- Severity
- medium
- Published
- Updated
Description
When sending Matrix requests using an affected version of matrix-sdk in an application that writes logs using tracing-subscriber (in a way that includes fields of tracing spans such as tracing_subscribers default text output from the fmt module), these logs will contain the user's access token.