{"id":"CVE-2025-32377","aliases":["EUVD-2025-11897","GHSA-7xq5-54jp-2mfg","PYSEC-2026-1862"],"status":"published","title":"Rasa Pro Missing Authentication For Voice Connector APIs","description":"Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This issue has been patched for audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00481,"percentile":0.41984,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306"],"published":"2025-04-17T18:33:20Z","modified":"2026-07-07T17:57:10Z","fixes":[{"ecosystem":"PyPI","package":"rasa-pro","fixed_in":["3.12.6","3.11.7","3.10.19","3.9.20"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"rasa-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.0"},{"last_affected":"3.12.5"},{"fixed":"3.12.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"rasa-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.0"},{"last_affected":"3.11.6"},{"fixed":"3.11.7"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"rasa-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0"},{"last_affected":"3.10.18"},{"fixed":"3.10.19"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"rasa-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.9.17"},{"fixed":"3.9.20"}]}]},{"source":"osv","ecosystem":"PyPI","package":"rasa-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.0"},{"fixed":"3.12.6"}]}],"versions":["3.12.0","3.12.1","3.12.1.dev1","3.12.1.dev2","3.12.2","3.12.2.dev2","3.12.2.dev3","3.12.2.dev4","3.12.3","3.12.4","3.12.5","3.12.6.dev1","3.12.6.dev2"]},{"source":"osv","ecosystem":"PyPI","package":"rasa-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.0"},{"fixed":"3.11.7"}]}],"versions":["3.11.0","3.11.1","3.11.2","3.11.3","3.11.3a1.dev1","3.11.3a1.dev2","3.11.3a1.dev4","3.11.3a1.dev5","3.11.3a1.dev6","3.11.3a1.dev7","3.11.4","3.11.5","3.11.6"]},{"source":"osv","ecosystem":"PyPI","package":"rasa-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0"},{"fixed":"3.10.19"}]}],"versions":["3.10.10","3.10.11","3.10.12","3.10.13","3.10.13a1","3.10.14","3.10.15","3.10.16","3.10.17","3.10.18","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.10.7.dev1","3.10.7.dev2","3.10.7.dev3","3.10.7.dev4","3.10.7.dev5","3.10.8","3.10.9","3.10.9.dev1"]},{"source":"osv","ecosystem":"PyPI","package":"rasa-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.20"}]}],"versions":["0.0.1","0.0.1.post1","3.8.16","3.8.17","3.8.18","3.9.14","3.9.15","3.9.16","3.9.17","3.9.18","3.9.19"]},{"source":"osv","ecosystem":"PyPI","package":"rasa-pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.20"},{"introduced":"3.10.0"},{"fixed":"3.10.19"},{"introduced":"3.11.0"},{"fixed":"3.11.7"},{"introduced":"3.12.0"},{"fixed":"3.12.6"}]}],"versions":["0.0.1","0.0.1.post1","3.10.10","3.10.11","3.10.12","3.10.13","3.10.13a1","3.10.14","3.10.15","3.10.16","3.10.17","3.10.18","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.10.7.dev1","3.10.7.dev2","3.10.7.dev3","3.10.7.dev4","3.10.7.dev5","3.10.8","3.10.9","3.10.9.dev1","3.11.0","3.11.1","3.11.2","3.11.3","3.11.3a1.dev1","3.11.3a1.dev2","3.11.3a1.dev4","3.11.3a1.dev5","3.11.3a1.dev6","3.11.3a1.dev7","3.11.4","3.11.5","3.11.6","3.12.0","3.12.1","3.12.1.dev1","3.12.1.dev2","3.12.2","3.12.2.dev2","3.12.2.dev3","3.12.2.dev4","3.12.3","3.12.4","3.12.5","3.12.6.dev1","3.12.6.dev2","3.8.16","3.8.17","3.8.18","3.9.14","3.9.15","3.9.16","3.9.17","3.9.18","3.9.19"]}],"products":[{"vendor":"rasahq","product":"rasa-pro-security-advisories"}],"references":[{"url":"https://github.com/RasaHQ/security-advisories/security/advisories/GHSA-7xq5-54jp-2mfg","tags":["x_refsource_CONFIRM","web"]},{"url":"https://github.com/RasaHQ/rasa-pro-security-advisories/security/advisories/GHSA-7xq5-54jp-2mfg","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32377","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7xq5-54jp-2mfg","tags":["advisory"]},{"url":"https://pypi.org/project/rasa-pro","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-32377","title":"Rasa Pro Missing Authentication For Voice Connector APIs","description":"Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This issue has been patched for audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6.","status":"published","published":"2025-04-18T19:59:32.286Z","modified":"2025-04-18T20:35:41.744Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:32:46.109993Z"}],"euvd":[{"id":"EUVD-2025-11897","description":"Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This issue has been patched for audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6.","status":"published","published":"2025-04-18T19:59:32Z","modified":"2025-04-18T20:35:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:19.650141Z"}],"ghsa":[{"id":"GHSA-7xq5-54jp-2mfg","title":"Rasa Pro Missing Authentication For Voice Connector APIs","description":"## Vulnerability\nA vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the `credentials.yml` file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source.\n\nThis impacts the following connectors:\n\n- `audiocodes_stream`\n- `genesys`\n- `jambonz`\n\nAs part of our investigation to resolve this issue, we have also performed a security review of our other voice channel connectors:\n\n- `browser_audio`: Does not support authentication. This is a development channel not intended for production use.\n- `twilio_media_streams`, `twilio_voice` and `jambonz`: Authentication is currently not supported by these channels, but our investigation has found a way for us to enable it for these voice channel connectors in a future Rasa Pro release.\n\n## Fix\nThe issue has been resolved for `audiocodes`, `audiocodes_stream`, and `genesys` connectors. Fixed versions of Rasa Pro have been released for `3.9.20`, `3.10.19`, `3.11.7` and `3.12.6`. Please update to a fixed release.\n\nIf you are using one of the affected connectors, we strongly recommend upgrading to a fixed version. For connectors where authentication is not supported (e.g., Twilio), we suggest taking extra caution and considering other compensating controls if applicable.","status":"published","published":"2025-04-17T18:33:20Z","modified":"2025-04-23T14:34:47Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:38:40.628275Z"}],"nvd":[{"id":"CVE-2025-32377","description":"Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This issue has been patched for audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6.","status":"published","published":"2025-04-18T20:15:16.67Z","modified":"2026-06-17T09:11:54.233Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:11:01.507281Z"}],"osv":[{"id":"GHSA-7xq5-54jp-2mfg","title":"Rasa Pro Missing Authentication For Voice Connector APIs","description":"## Vulnerability\nA vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the `credentials.yml` file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source.\n\nThis impacts the following connectors:\n\n- `audiocodes_stream`\n- `genesys`\n- `jambonz`\n\nAs part of our investigation to resolve this issue, we have also performed a security review of our other voice channel connectors:\n\n- `browser_audio`: Does not support authentication. This is a development channel not intended for production use.\n- `twilio_media_streams`, `twilio_voice` and `jambonz`: Authentication is currently not supported by these channels, but our investigation has found a way for us to enable it for these voice channel connectors in a future Rasa Pro release.\n\n## Fix\nThe issue has been resolved for `audiocodes`, `audiocodes_stream`, and `genesys` connectors. Fixed versions of Rasa Pro have been released for `3.9.20`, `3.10.19`, `3.11.7` and `3.12.6`. Please update to a fixed release.\n\nIf you are using one of the affected connectors, we strongly recommend upgrading to a fixed version. For connectors where authentication is not supported (e.g., Twilio), we suggest taking extra caution and considering other compensating controls if applicable.","status":"published","published":"2025-04-17T18:33:20Z","modified":"2026-07-07T17:57:10.561101362Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"PYSEC-2026-1862","title":"Rasa Pro Missing Authentication For Voice Connector APIs","description":"## Vulnerability\nA vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the `credentials.yml` file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source.\n\nThis impacts the following connectors:\n\n- `audiocodes_stream`\n- `genesys`\n- `jambonz`\n\nAs part of our investigation to resolve this issue, we have also performed a security review of our other voice channel connectors:\n\n- `browser_audio`: Does not support authentication. This is a development channel not intended for production use.\n- `twilio_media_streams`, `twilio_voice` and `jambonz`: Authentication is currently not supported by these channels, but our investigation has found a way for us to enable it for these voice channel connectors in a future Rasa Pro release.\n\n## Fix\nThe issue has been resolved for `audiocodes`, `audiocodes_stream`, and `genesys` connectors. Fixed versions of Rasa Pro have been released for `3.9.20`, `3.10.19`, `3.11.7` and `3.12.6`. Please update to a fixed release.\n\nIf you are using one of the affected connectors, we strongly recommend upgrading to a fixed version. For connectors where authentication is not supported (e.g., Twilio), we suggest taking extra caution and considering other compensating controls if applicable.","status":"published","published":"2026-07-07T16:02:51.197156Z","modified":"2026-07-07T17:47:00.41303307Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}