Cisco Webex App
CVE-2026-20178
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered redirect requires user click (UI:R), no attacker auth needed (PR:N), scope unchanged, with only limited integrity impact and no confidentiality or availability consequence.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticated, remote attacker to redirect users to a malicious webpage. Cisco has addressed this vulnerability in the Cisco Webex App, and no customer action is needed. This vulnerability existed due to improper input validation of URL parameters in an HTTP request. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to click a crafted URL. A successful exploit could have allowed the attacker to redirect a user to a malicious website.
AnalysisAI
Open redirect in the browser-based Cisco Webex App allowed unauthenticated remote attackers to redirect users to attacker-controlled websites by crafting malicious URLs with manipulated parameters. The vulnerability (CWE-601) stems from improper input validation of URL parameters in HTTP requests and scores CVSS 4.3 Medium (AV:N/AC:L/PR:N/UI:R). Cisco has fully remediated this server-side with no customer action required; no public exploit or CISA KEV listing exists at time of analysis.
Technical ContextAI
The affected component is the browser-based interface of the Cisco Webex App (CPE: cpe:2.3:a:cisco:cisco_webex_app:*:*:*:*:*:*:*:*), distinct from the native desktop or mobile clients. CWE-601 (URL Redirection to Untrusted Site) identifies the root cause class: the application accepted URL parameters in HTTP requests without validating or allowlisting the redirect destination, permitting substitution of an arbitrary external URL. In browser-hosted collaboration apps, redirect parameters are commonly used for post-authentication flows or deep-linking; failure to enforce an origin allowlist on these parameters is the archetypal CWE-601 pattern. The trusted Cisco/Webex domain context makes such crafted links more persuasive to victims than generic phishing URLs, amplifying the social engineering potential beyond what the CVSS score alone conveys.
RemediationAI
Cisco has fully remediated this vulnerability server-side; no patch deployment, configuration change, or upgrade is required from customers or administrators. The fix has been applied to Cisco-hosted Webex App infrastructure, as confirmed by the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-redirect-KOyxhffH. As a defense-in-depth measure, organizations may consider reinforcing user security awareness training focused on verifying full URLs - including all query parameters - before clicking links, even when the domain appears trustworthy. Email gateway policies that strip or flag URLs containing suspicious redirect parameters to Webex App endpoints could serve as an additional compensating control, though this may interfere with legitimate deep-linking workflows.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today