CVE-2026-25058

CVE-2026-25058 is an authentication bypass vulnerability in Vexa, an open-source self-hostable meeting bot and transcription API, affecting versions prior to 0.10.0-260419-1910. The transcription-collector service exposes an internal endpoint that returns transcript data without any authentication or authorization controls, allowing unauthenticated attackers to enumerate meeting IDs and access any user's meeting transcripts. This could result in exposure of confidential business conversations, credentials, and personally identifiable information. The vulnerability presents a HIGH severity risk with a CVSS score of 7.5, exploitable over the network with low attack complexity and no authentication requirements. The attack requires no user interaction and has a high confidentiality impact, though integrity and availability are not affected. The EPSS score of 0.00053 indicates this vulnerability has lower exploitation probability compared to the broader vulnerability population. There is currently no evidence of active exploitation in the wild, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. However, organizations running affected Vexa versions should upgrade to 0.10.0-260419-1910 or later immediately given the ease of exploitation and sensitive nature of meeting transcripts. Community attention remains limited, suggesting this may be a lower-profile open-source project.