Vexa
Monthly
Unauthenticated access to meeting transcripts in Vexa transcription-collector service versions before 0.10.0-260419-1910 allows remote attackers to retrieve sensitive business conversations, credentials, and personally identifiable information. The service exposes an internal endpoint without authentication, enabling enumeration of meeting IDs and bulk extraction of confidential data. No public exploit identified at time of analysis, but exploitation requires only standard HTTP requests with no special conditions (CVSS AV:N/AC:L/PR:N/UI:N).
Server-Side Request Forgery in Vexa meeting bot allows unauthenticated remote attackers to forge HTTP POST requests to arbitrary internal URLs (Redis, databases, cloud metadata endpoints) via unvalidated webhook configuration, enabling credential theft and lateral movement. CVSS 5.8 with network attack vector and no user interaction required. Fixed in version 0.10.0-260419-1910.
Unauthenticated access to meeting transcripts in Vexa transcription-collector service versions before 0.10.0-260419-1910 allows remote attackers to retrieve sensitive business conversations, credentials, and personally identifiable information. The service exposes an internal endpoint without authentication, enabling enumeration of meeting IDs and bulk extraction of confidential data. No public exploit identified at time of analysis, but exploitation requires only standard HTTP requests with no special conditions (CVSS AV:N/AC:L/PR:N/UI:N).
Server-Side Request Forgery in Vexa meeting bot allows unauthenticated remote attackers to forge HTTP POST requests to arbitrary internal URLs (Redis, databases, cloud metadata endpoints) via unvalidated webhook configuration, enabling credential theft and lateral movement. CVSS 5.8 with network attack vector and no user interaction required. Fixed in version 0.10.0-260419-1910.