CVE-2026-25883

CVE-2026-25883 affects Vexa, an open-source meeting bot and transcription API, in versions prior to 0.10.0-260419-1910. The vulnerability exists in the webhook configuration feature, which allows authenticated users to specify arbitrary URLs for receiving HTTP POST requests upon meeting completion. Due to insufficient URL validation, attackers can exploit this functionality to conduct Server-Side Request Forgery (SSRF) attacks against internal infrastructure, including Redis instances, databases, and administrative panels, as well as cloud metadata endpoints for credential harvesting. The vulnerability carries a CVSS score of 5.8 (Medium severity) with a network-based attack vector requiring no user interaction, though it does require valid authentication credentials. The primary impact is limited information disclosure through access to confidential data on internal services and cloud environments, while integrity and availability are not directly affected. The EPSS score of 0.00028 indicates minimal exploitation likelihood relative to other disclosed vulnerabilities. There is no evidence of active exploitation in the wild, and the vulnerability does not appear on the CISA KEV catalog or industry hot lists. The patch is available in version 0.10.0-260419-1910 and should be applied to all affected deployments. Given the authentication requirement and moderate severity profile, this represents a lower-priority threat suitable for standard patch management cycles.