CVE-2026-4984

HighCVSS 8.2/10Last modified Aug 18, 2026

Description

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'.

When processing media messages, it fetches user-controlled URLs ('MediaUrlN' parameters) using HTTP requests that include the integration's Twilio credentials in the 'Authorization' header.

An attacker can forge a webhook payload pointing to their own server and receive the victim's 'accountSID' and 'authToken' in plaintext (base64-encoded Basic Auth), leading to full compromise of the Twilio account.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-345 CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2026
Last modified: Aug 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-498409.1FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement CVE-2026-498419.8FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement CVE-2026-498427.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement CVE-2026-498435.3FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement CVE-2026-498445.9Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not v CVE-2026-498459.8SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users CVE-2026-498467.5libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails t CVE-2026-498477.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement CVE-2026-498484.3FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement CVE-2026-498499.1xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated CVE-2026-49854.3A vulnerability was identified in dloebl CGIF up to 0.5.2. This vulnerability affects the function cgif_addframe of the file src/cgif.c of t CVE-2026-498507.5InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Inv