EUVD-2026-23893Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
6DescriptionGitHub Advisory
Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa webhook feature allows authenticated users to configure an arbitrary URL that receives HTTP POST requests when meetings complete. The application performs no validation on the webhook URL, enabling Server-Side Request Forgery (SSRF). An authenticated attacker can set their webhook URL to target internal services (Redis, databases, admin panels), cloud metadata endpoints (AWS/GCP credential theft), and/or localhost services. Version 0.10.0-260419-1910 patches the issue.
AnalysisAI
Server-Side Request Forgery in Vexa meeting bot allows unauthenticated remote attackers to forge HTTP POST requests to arbitrary internal URLs (Redis, databases, cloud metadata endpoints) via unvalidated webhook configuration, enabling credential theft and lateral movement. CVSS 5.8 with network attack vector and no user interaction required. Fixed in version 0.10.0-260419-1910.
Technical ContextAI
Vexa is a self-hosted meeting bot and transcription API that implements webhook callbacks to notify external systems when meetings complete. The vulnerability stems from CWE-918 (Server-Side Request Forgery), where the application fails to validate or sanitize webhook URLs before making HTTP POST requests. An attacker can specify URLs pointing to internal services (localhost Redis instances, private database endpoints, cloud metadata services like AWS EC2 Instance Metadata Service or GCP metadata endpoints) or admin panels. Because the server initiates outbound requests from its internal network context, it bypasses client-side network segmentation and can access resources unreachable from the internet, including credential endpoints (169.254.169.254 for cloud credentials) and internal service management interfaces.
RemediationAI
Upgrade Vexa immediately to version 0.10.0-260419-1910 or later, which patches webhook URL validation. If immediate patching is not possible, disable the webhook feature entirely in Vexa configuration (check application settings for webhook toggle/disable option) until the patched version is deployed - this eliminates the attack surface while maintaining core meeting bot functionality. Additionally, implement network-level mitigations: restrict outbound HTTP/HTTPS traffic from the Vexa server to a whitelist of known external webhook endpoints using egress firewall rules, and block access to cloud metadata endpoints (169.254.169.254, metadata.google.internal) and internal services (Redis ports 6379, database ports) via network ACLs or iptables rules on the Vexa host. Document approved webhook URLs and enforce them via a configuration whitelist if the patched version does not include built-in URL validation - contact the maintainers or contribute a stricter validation rule (HTTPS-only, domain whitelist, explicit IP restrictions). Monitor outbound connections from Vexa for suspicious requests to 169.254.169.254 or internal service ports as a detection control.
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today