CVE-2026-4984
Severity CVSS v4.0:
Pending analysis
Type:
CWE-345
Insufficient Verification of Data Authenticity
Publication date:
27/03/2026
Last modified:
10/05/2026
Description
The Twilio integration webhook handler accepts any POST request without validating Twilio&#39;s &#39;X-Twilio-Signature&#39;.<br />
<br />
When processing media messages, it fetches user-controlled URLs (&#39;MediaUrlN&#39; parameters) using HTTP requests that include the integration&#39;s Twilio credentials in the &#39;Authorization&#39; header.<br />
<br />
An attacker can forge a webhook payload pointing to their own server and receive the victim&#39;s &#39;accountSID&#39; and &#39;authToken&#39; in plaintext (base64-encoded Basic Auth), leading to full compromise of the Twilio account.
Impact
Base Score 3.x
8.20
Severity 3.x
HIGH