CVE-2026-25883

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa webhook feature allows authenticated users to configure an arbitrary URL that receives HTTP POST requests when meetings complete. The application performs no validation on th...

CVE-2026-25883

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa webhook feature allows authenticated users to configure an arbitrary URL that receives HTTP POST requests when meetings complete. The application performs no validation on th...

CVE-2026-25058

CVE-2026-25058 affects Vexa. The transcription-collector exposes an unauthenticated internal endpoint GET /internal/transcripts/{meeting_id}, allowing enumeration of meeting IDs and access to any user’s transcripts without authentication. Root cause: missing auth checks on the internal transcript...