CVE-2026-4984
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
27/03/2026
Última modificación:
30/03/2026
Descripción
*** Pendiente de traducción *** The Twilio integration webhook handler accepts any POST request without validating Twilio&#39;s &#39;X-Twilio-Signature&#39;.<br />
<br />
When processing media messages, it fetches user-controlled URLs (&#39;MediaUrlN&#39; parameters) using HTTP requests that include the integration&#39;s Twilio credentials in the &#39;Authorization&#39; header.<br />
<br />
An attacker can forge a webhook payload pointing to their own server and receive the victim&#39;s &#39;accountSID&#39; and &#39;authToken&#39; in plaintext (base64-encoded Basic Auth), leading to full compromise of the Twilio account.
Impacto
Puntuación base 3.x
8.20
Gravedad 3.x
ALTA