CVE-2026-4984 | BDVDB-2026-323342 Detail

Description#

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs ('MediaUrlN' parameters) using HTTP requests that include the integration's Twilio credentials in the 'Authorization' header. An attacker can forge a webhook payload pointing to their own server and receive the victim's 'accountSID' and 'authToken' in plaintext (base64-encoded Basic Auth), leading to full compromise of the Twilio account.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-27Record published in the CVE List.
2. Version 22026-05-10Most recent update recorded in the CVE List.