CVE-2025-20291 Overview
Cisco Webex Meetings contained an open redirect vulnerability that allowed unauthenticated remote attackers to redirect users to attacker-controlled websites. The flaw stemmed from insufficient validation of URLs embedded in meeting-join URLs. An attacker could craft a Webex Meetings join URL containing a target destination in a specific parameter value. When a victim clicked the link, the Webex service redirected them to the attacker's site, lending apparent legitimacy to phishing pages. Cisco resolved the issue directly within the Cisco Webex Meetings service, and no customer action is required. The vulnerability is tracked under [CWE-601] Open Redirect.
Critical Impact
Attackers could weaponize trusted Webex join URLs to redirect users to phishing infrastructure, increasing the success rate of credential theft campaigns.
Affected Products
- Cisco Webex Meetings (cloud service)
- Meeting-join URL handler component
- Users clicking crafted Webex Meetings invitation links
Discovery Timeline
- 2025-09-03 - CVE-2025-20291 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-20291
Vulnerability Analysis
The vulnerability is an open redirect classified under [CWE-601]. Cisco Webex Meetings accepted a URL value as part of the meeting-join URL structure. The service did not sufficiently validate that the embedded URL pointed to a trusted destination. An unauthenticated remote attacker could craft a join URL containing an arbitrary destination and distribute it through email, chat, or social channels. When a target clicked the link, the Webex service processed the join request and redirected the browser to the attacker-supplied destination. Because the initial hostname belonged to Cisco Webex, the user was more likely to trust the resulting page. Attackers commonly pair this technique with credential harvesting or malware delivery pages that mimic Webex or corporate login interfaces.
Root Cause
The root cause was insufficient allowlist validation of URLs supplied through a specific query parameter within Webex meeting-join URLs. The service treated the supplied value as a redirect target without confirming that the destination resolved to a Cisco-owned or otherwise sanctioned domain.
Attack Vector
Exploitation required user interaction. The attacker generated a malicious join URL, delivered it to the target through phishing or social engineering, and relied on the victim to click the link. No authentication, elevated privileges, or local access to the target system was required. The scope changed because the redirect crossed from the Webex origin into an attacker-controlled origin.
No verified exploit code has been published. See the Cisco Security Advisory for vendor technical details.
Detection Methods for CVE-2025-20291
Indicators of Compromise
- Webex meeting-join URLs containing unusually long or encoded redirect parameter values pointing to non-Cisco domains
- Web proxy or SASE logs showing user traffic transitioning from webex.com hosts to unrelated external domains within the same session
- Phishing emails referencing Webex meetings with join links that fail hostname or parameter integrity checks
Detection Strategies
- Inspect inbound email and chat channels for Webex join URLs and parse embedded parameters for external URL values
- Correlate HTTP referrer chains in proxy logs to identify redirects originating from Webex domains to unknown external hosts
- Alert on Webex-branded URLs delivered from senders outside expected meeting organizers or partner domains
Monitoring Recommendations
- Enable URL rewriting and time-of-click protection in email security gateways for all Webex join links
- Log and review browser telemetry for redirect chains that pass through Webex hostnames to external destinations
- Track user reports of suspicious Webex invitations and cross-reference against phishing threat intelligence feeds
How to Mitigate CVE-2025-20291
Immediate Actions Required
- No customer action is required. Cisco addressed the vulnerability directly in the Cisco Webex Meetings service.
- Confirm that user-facing Webex traffic is routing through current Cisco service endpoints and that legacy cached URLs are not in circulation.
- Reinforce phishing awareness training that highlights redirect-based abuse of trusted collaboration platforms.
Patch Information
Cisco resolved the vulnerability server-side within the Cisco Webex Meetings service. No client update, configuration change, or version upgrade is required. Refer to the Cisco Security Advisory cisco-sa-webex-urlredirect-uK8dDJSZ for the official statement.
Workarounds
- Apply email security policies that inspect and rewrite Webex meeting-join URLs prior to delivery
- Block or warn on outbound HTTP requests where the referrer is a Webex domain and the destination is an unclassified external host
- Educate users to hover over Webex join links and validate parameter contents before clicking
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
