The vulnerability arises from an insecure server key generation method in the ESS Community Helm Chart's secrets initialization hook, allowing network attackers to recreate the same key pair and impersonate the Matrix server. This could enable attackers to generate events and authenticate requests as the server, potentially compromising the confidentiality, integrity, and availability of rooms that include the vulnerable server as a member. The confidentiality of past conversations in end‑to‑end encrypted rooms is explicitly stated to remain unaffected.

Element Server Suite Community Edition deploying Matrix via the ESS Community Helm Chart is affected. Versions of the helm chart prior to 25.12.1, which bundle matrix-tools prior to version 0.5.7, generate the key insecurely if initSecrets.enabled is not disabled and synapse.signingKey is not predefined. Stakeholders using matrix-tools prior to 0.5.7 in this context are at risk.

The CVSS score of 9.2 classifies this as a high‑severity vulnerability, and the EPSS score of less than 1% indicates a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network attacker targeting the Kubernetes environment hosting the ESS Community Helm Chart, exploiting the insecure key generation to impersonate the server. Exploitation requires network reach to the cluster or the ability to influence the initialization process of the secrets hook.