ZeroDay Findings
Sign inSign up

Findings

CVE-2026-25058

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API.

Published Apr 20, 2026 · updated Jun 17, 2026 · vexa vexa

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service exposes an internal endpoint that returns transcript data for any meeting without any authentication or authorization checks. An unauthenticated attacker can enumerate all meeting IDs, access any user's meeting transcripts without credentials, and steal confidential business conversations, passwords, and/or PII. Version 0.10.0-260419-1910 patches the issue.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 20, 2026 · NIST NVD

    Detected

    Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service exposes an internal endpoint that returns transcript data for any meeting without any authentication or authorization checks. An unauthenticated attacker can enumerate all meeting IDs, access any user's meeting transcripts without credentials, a

  2. Jun 17, 2026 · NIST NVD

    Updated

    Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service exposes an internal endpoint that returns transcript data for any meeting without any authentication or authorization checks. An unauthenticated attacker can enumerate all meeting IDs, access any user's meeting transcripts without credentials, a

Affected

  • cpe vexa/vexaversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-25058

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-25058

    Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service exposes an internal endpoint that returns transcript data for any meeting without an

    nvd.nist.gov

References