{"id":"CVE-2026-4984","summary":"Botpress - Credential Disclosure via Twilio Webhook Handler","details":"The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'.\n\nWhen processing media messages, it fetches user-controlled URLs ('MediaUrlN' parameters) using HTTP requests that include the integration's Twilio credentials in the 'Authorization' header.\n\nAn attacker can forge a webhook payload pointing to their own server and receive the victim's 'accountSID' and 'authToken' in plaintext (base64-encoded Basic Auth), leading to full compromise of the Twilio account.","modified":"2026-10-08T02:54:18.216817703Z","published":"2026-03-27T14:13:51.003Z","database_specific":{"cna_assigner":"tenable","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4984.json"},"references":[{"type":"WEB","url":"https://www.tenable.com/security/research/tra-2026-22"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4984.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4984"},{"type":"PACKAGE","url":"https://github.com/botpress/botpress"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/botpress/botpress","events":[{"introduced":"0"},{"last_affected":"0"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0"}],"source":"AFFECTED_FIELD"}}],"versions":["0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4984.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"}]}