CVE-2026-25883

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-25883

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25883.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-25883

Aliases

GHSA-fhr6-8hff-cvg4

Published

2026-04-20T16:04:36.584Z

Modified

2026-07-15T01:49:02.253063250Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

Vexa Webhook Feature has a SSRF Vulnerability

Details

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa webhook feature allows authenticated users to configure an arbitrary URL that receives HTTP POST requests when meetings complete. The application performs no validation on the webhook URL, enabling Server-Side Request Forgery (SSRF). An authenticated attacker can set their webhook URL to target internal services (Redis, databases, admin panels), cloud metadata endpoints (AWS/GCP credential theft), and/or localhost services. Version 0.10.0-260419-1910 patches the issue.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "0.10.0-260419-1910"
                }
            ]
        }
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25883.json",
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Git / github.com/vexa-ai/vexa

Affected ranges

Type

GIT

Repo

https://github.com/vexa-ai/vexa

Events

Introduced

Last affected

d06a319ecc1613bce6d83a706b225ba525506135

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.10"
        }
    ],
    "cpe": "cpe:2.3:a:vexa:vexa:*:*:*:*:*:*:*:*"
}

Affected versions

v0.*

v0.10

v0.2

v0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25883.json"