CVE-2026-4984

Katalog CVE

CVSS 8.2 · High EPSS 0,18%

Kerentanan Insufficient Verification of Data Authenticity pada botpress. Skor CVSS 3.1 8.2 (High) menurut tenable.com.

Deskripsi (NVD)

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs ('MediaUrlN' parameters) using HTTP requests that include the integration's Twilio credentials in the 'Authorization' header. An attacker can forge a webhook payload pointing to their own server and receive the victim's 'accountSID' and 'authToken' in plaintext (base64-encoded Basic Auth), leading to full compromise of the Twilio account.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber tenable.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity
CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tenable.com/security/research/tra-2026-22 advisory pihak ketiga