Vexa Meeting Bot Exposes Unauthenticated Transcripts

The National Vulnerability Database has detailed CVE-2026-25058, affecting Vexa, an open-source, self-hostable meeting bot and transcription API. Prior to version 0.10.0-260419-1910, the Vexa transcription-collector service exposed an internal endpoint that allowed unauthenticated access to meeting transcript data. This critical flaw means any attacker could enumerate meeting IDs and retrieve full transcripts without credentials.

This vulnerability, with a CVSS score of 7.5 (HIGH), represents a significant data leakage risk. Attackers can steal confidential business conversations, PII, and potentially even credentials if they were discussed during meetings. The root cause, according to the National Vulnerability Database, lies in a lack of authentication and authorization checks (CWE-306, CWE-862) on a sensitive internal endpoint. The fix is available in Vexa version 0.10.0-260419-1910.

For defenders, this is a stark reminder that internal API endpoints are not inherently secure. Assuming a service is ‘internal’ and thus protected by network boundaries is a dangerous gamble. Attackers will find a way in, and if the application itself lacks robust authentication, the game is over.