CVE-2026-4984
Published: 27 March 2026
Summary
CVE-2026-4984 is a high-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-9 (Service Identification and Authentication) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4984 affects the Twilio integration webhook handler, which accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, the handler fetches user-controlled URLs specified in 'MediaUrlN' parameters via HTTP requests that include the integration's Twilio credentials in the 'Authorization' header. Published on 2026-03-27, this flaw has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
An unauthenticated attacker (PR:N) can exploit this remotely over the network (AV:N) with low complexity (AC:L) by forging a webhook payload that points 'MediaUrlN' to a server they control. Upon processing, the handler sends an HTTP request to the attacker's server, exposing the victim's Twilio 'accountSID' and 'authToken' in plaintext within a base64-encoded Basic Auth 'Authorization' header, enabling full compromise of the Twilio account.
The Tenable advisory at https://www.tenable.com/security/research/tra-2026-22 provides further details on mitigation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16632
Vulnerability details
The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs ('MediaUrlN' parameters) using HTTP requests that include the integration's Twilio credentials in the 'Authorization' header. An attacker can forge…
more
a webhook payload pointing to their own server and receive the victim's 'accountSID' and 'authToken' in plaintext (base64-encoded Basic Auth), leading to full compromise of the Twilio account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in unauthenticated public webhook handler enables direct exploitation of public-facing application (T1190) to force leakage of Twilio API credentials, directly facilitating theft of application access tokens (T1528) for account compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification and authentication of external services like Twilio webhooks using 'X-Twilio-Signature' before processing payloads, directly preventing forged requests.
Mandates validation of information inputs including webhook signatures and 'MediaUrlN' parameters to block malicious payloads and untrusted URLs.
Monitors and controls communications at system boundaries to restrict outbound HTTP requests carrying Twilio credentials to attacker-controlled servers.