Vulnerability · Published Apr 20, 2026 · Assigned by GitHub_M

CVE-2026-25058Vexa's unauthenticated internal transcript endpoint exposed by default

High 7.5

In plain English

A high-severity missing authentication in vexa from Vexa-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service exposes an internal endpoint `GET /internal/transcripts/{meeting_id}` that returns transcript data for any meeting without any authentication or authorization checks. An unauthenticated attacker can enumerate all meeting IDs, access any user's meeting transcripts without credentials, and steal confidential business conversations, passwords, and/or PII. Version 0.10.0-260419-1910 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
Vexa-ai	vexa	< 0.10.0-260419-1910

Weakness: CWE-306, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/Vexa-ai/vexa/security/advisories/GHSA-w73r-2449-qwgh x_refsource_CONFIRM