The server versions cache is unaware of the homeserver URL

[pixlwave]

Steps to reproduce:

• Build a Client with serverNameOrHomeserverUrl("matrix.org") but don’t log in/use the client.
• Build a Client with serverNameOrHomeserverUrl("element.io") using the same sessionPath (as you didn’t use the previous client) and log in.
• The client will use the server versions from matrix.org whilst talking to element.io (i.e. it attempts to use the authenticated media APIs)

[bnjbvr]

using the same sessionPath (as you didn’t use the previous client)

This is super dangerous, reusing the same path means reusing the same data from all the state store. The assumption was that one new client = one new store = one empty directory for the session. In general, it's your responsibility as an embedder to ensure that the directory is empty before creating the client: here, it's the server versions that's affected, but technically every cached value could tried to be reused by the next client, and things could go wrong in multiple ways that are even more confusing.