Cisco Webex Meetings URL Redirection Vulnerability

TL;DR 📌

A medium-severity vulnerability in Cisco Webex Meetings could allow an unauthenticated attacker to redirect users to untrusted websites. Cisco has addressed this issue, and no action is required from users.

What happened 🕵️‍♂️

A vulnerability in Cisco Webex Meetings was discovered, which could allow an unauthenticated, remote attacker to redirect a targeted user to an untrusted website. This issue arose due to insufficient validation of URLs included in meeting-join links. If exploited, this could facilitate phishing attacks by misleading users into believing they were interacting with a trusted Webex environment.

Affected products 🖥️

• Cisco Webex Meetings (cloud-based)

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address this vulnerability.

Risk in context 🎯

The vulnerability has a CVSS score of 4.3, indicating a medium risk. While it does not require authentication and could potentially lead to phishing attempts, the lack of known exploitation or public announcements about this vulnerability mitigates immediate concerns.

Fast facts ⚡

• CVE Identifier: CVE-2025-20291
• CVSS Score: 4.3 (Medium)
• No user action required for remediation
• No workarounds available

For leadership 🧭

Executive summary. An open redirect in Webex Meetings join links could be used to point staff towards a convincing lookalike page for phishing, though it does not itself compromise credentials or systems. There is no known exploitation and Cisco has already fixed the issue, so this is routine patching rather than an emergency.

Why it matters:

• The flaw sits in the meeting-join link flow that employees click daily, making a spoofed redirect plausible as a phishing lure disguised as a legitimate Webex invite.
• No authentication is required to exploit it, so any attacker able to distribute a crafted join link can attempt the redirect against unsuspecting recipients.
• There are no workarounds, so exposure continues until the fixed Webex Meetings release is applied.
• Cisco Webex Meetings is cloud-based, meaning the fix depends on Cisco’s own update rollout rather than a client-side patch you control.

Now / Next / Later:

• Now: Check which Webex Meetings release your organisation is running and confirm whether Cisco has already applied the fix on the cloud service or whether client-side action is needed.
• Next: Apply the first fixed Webex Meetings release identified by Cisco in your normal update cycle, since no workaround exists to bridge the gap.
• Later: Reinforce user awareness that meeting-join links should be verified before clicking, and monitor Cisco advisories for follow-up guidance on Webex URL handling.