CVE-2026-123787
Deferred Deferred - Pending Action

Information Disclosure in VidBee Local HTTP Service

Publication date: 2026-11-06

Last updated on: 2026-11-06

Assigner: VulDB

Description
A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-06
Last Modified
2026-11-06
Generated
2026-11-06
AI Q&A
2026-11-06
EPSS Evaluated
N/A
NVD
CVE-2026-123787
EUVD
EUVD-2026-118498

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nexmoe vidbee 1.3.13
nexmoe vidbee 2.0.2
nexmoe vidbee 2.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure weakness in nexmoe VidBee up to versions 1.3.13 or 2.0.2. It involves an unauthenticated local HTTP service running on loopback addresses (127.0.0.1) that exposes sensitive endpoints due to overly permissive CORS headers. Attackers can remotely access these endpoints to leak tokens, download task details, or manipulate downloads without authentication.

Detection Guidance

Check if VidBee Desktop is running a local HTTP service on loopback addresses (127.0.0.1) on ports 27100-27120. Use commands like 'netstat -tuln | grep 271' or 'ss -tuln | grep 271' to identify open ports. Test endpoints like http://127.0.0.1:27100/status or http://127.0.0.1:27100/video-info using curl to see if they respond without authentication.

Verify CORS headers by inspecting responses from these endpoints. If headers include 'Access-Control-Allow-Origin: *', the system is vulnerable. Use browser developer tools or curl to check headers.

Impact Analysis

An attacker could exploit this to read your VidBee download tasks, access tokens, or even add malicious download tasks. Since the service runs locally, any website you visit could potentially interact with it if your browser allows cross-origin requests to 127.0.0.1. This could lead to privacy breaches or unauthorized downloads on your system.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data (e.g., download tasks, tokens) without user consent. For HIPAA, if VidBee handles protected health information during downloads or transcriptions, unauthorized access could compromise confidentiality. Organizations must ensure patches are applied to maintain compliance.

Mitigation Strategies

Upgrade VidBee to version 2.2.0 or later immediately. This version includes fixes for the unauthenticated local API and CORS issues. Download the update from the official VidBee releases page.

If upgrading is not immediately possible, disable the local HTTP service by stopping VidBee Desktop or blocking ports 27100-27120 using a firewall. Avoid using affected versions until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123787. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...