CVE-2026-4984

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The Twilio integration webhook handler fails to validate the X-Twilio-Signature on incoming POST requests. When processing media messages, the system fetches URLs provided in MediaUrlN parameters using HTTP requests that include the integration's Twilio credentials within the Authorization header. An attacker can forge a webhook payload pointing to a server under their control to capture the victim's accountSID and authToken in plaintext via base64-encoded Basic Auth, potentially resulting in a full compromise of the Twilio account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.