MSC4190: appservice `PUT /devices/{deviceId}` creates a device with a random ID instead of the requested one #2015

New issue

Open

opened 2026-07-17 10:56:39 +00:00 by Deniel9204 · 0 comments

Deniel9204 commented

2026-07-17 10:56:39 +00:00

MSC4190: appservice `PUT /devices/{deviceId}` creates a device with a random ID instead of the requested one

Version: main, image forgejo.ellis.link/continuwuation/continuwuity:main
built 2026-07-17T02:48Z, revision eff454218c65ae432d10f98f8be5aa74929e546a
(i.e. includes 1f5e178c3f "fix: Properly handle appservice device creation").

Summary

When an appservice creates a device for one of its users via MSC4190
(PUT /_matrix/client/v3/devices/{deviceId} with user_id masquerading),
continuwuity returns 200 {} but the device that actually gets stored has a
randomly generated device ID — not {deviceId} from the request path
(the requested display_name is dropped too). Every subsequent request that
masquerades as {deviceId} then fails:

M_FORBIDDEN: Device does not exist for user or appservice cannot masquerade as this device.

This makes every mautrix bridge with encryption.msc4190: true crash-loop at
startup (/keys/upload 403 on first boot, /keys/query 403 on later boots),
and each restart leaks one more orphaned random-ID device on the bridge bot.

# MSC4190: appservice `PUT /devices/{deviceId}` creates a device with a random ID instead of the requested one **Version:** `main`, image `forgejo.ellis.link/continuwuation/continuwuity:main` built 2026-07-17T02:48Z, revision `eff454218c65ae432d10f98f8be5aa74929e546a` (i.e. *includes* `1f5e178c3f` "fix: Properly handle appservice device creation"). ## Summary When an appservice creates a device for one of its users via MSC4190 (`PUT /_matrix/client/v3/devices/{deviceId}` with `user_id` masquerading), continuwuity returns `200 {}` but the device that actually gets stored has a **randomly generated device ID** — not `{deviceId}` from the request path (the requested `display_name` is dropped too). Every subsequent request that masquerades as `{deviceId}` then fails: ``` M_FORBIDDEN: Device does not exist for user or appservice cannot masquerade as this device. ``` This makes every mautrix bridge with `encryption.msc4190: true` crash-loop at startup (`/keys/upload` 403 on first boot, `/keys/query` 403 on later boots), and each restart leaks one more orphaned random-ID device on the bridge bot.