CVE-2025-32377CWE-306

Rasa Pro Missing Authentication For Voice Connector APIs

Medium · published April 18, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This issue has been patched for audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00472 · 39.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-04-18T19:59Z
EPSS history
Timeline
  • 18 APR 19:59Z
    Rasa Pro Missing Authentication For Voice Connector APIs
    cvelistv5