PT-2026-28704 · Twilio · Twilio Integration

Publicado 2026-03-27 · Atualizado 2026-03-27 · CVE-2026-4984

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Twilio integration (affected versions not specified)

Description The Twilio integration webhook handler improperly validates requests, accepting any POST request without verifying the 'X-Twilio-Signature' header. When handling media messages, the integration retrieves resources from user-controlled URLs, specifically the MediaUrlN parameters, using HTTP requests. These requests include the integration’s Twilio credentials in the 'Authorization' header. This allows an attacker to forge a webhook payload directed to their own server. Consequently, the attacker can obtain the victim’s 'accountSID' and 'authToken' in plaintext (base64-encoded Basic Auth), potentially leading to a complete compromise of the Twilio account. The API endpoint receiving the forged payload is the webhook handler. The vulnerable parameters are MediaUrlN.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-352

CWE-345

Identificadores relacionados

CVE-2026-4984

Produtos afetados

Twilio Integration

Referências · 3

• https://twitter.com/TheHackerWire/status/2037681058507083806 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4984 · Nota de Segurança
• https://tenable.com/security/research/tra-2026-22 · Nota