CVE-2026-25883

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa webhook feature allows authenticated users to configure an arbitrary URL that receives HTTP POST requests when meetings complete. The application performs no validation on the webhook URL, enabling Server-Side Request Forgery (SSRF). An authenticated attacker can set their webhook URL to target internal services (Redis, databases, admin panels), cloud metadata endpoints (AWS/GCP credential theft), and/or localhost services. Version 0.10.0-260419-1910 patches the issue.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Vexa-ai	vexa	< 0.10.0-260419-1910

References

https://github.com/Vexa-ai/vexa/security/advisories/GHSA-fhr6-8hff-cvg4Vendor Advisory

Timeline

Published: Apr 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-258848.1Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version CVE-2026-258857.5PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v CVE-2026-258877.2Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to vers CVE-2026-258888.8Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to vers CVE-2026-258895.4File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2026-25895.3The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t CVE-2026-258908.1File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2026-258917.5Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypas CVE-2026-258927.5Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed CVE-2026-258939.8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA al CVE-2026-258949.8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticate CVE-2026-258959.8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated,