A flaw in the single sign‑on integration with Control Hub allowed an attacker to supply a forged token and bypass certificate validation. The result is that the attacker could assume the identity of any Webex user, gaining full access to services and data they would normally be denied. The weakness is a classic certificate trust flaw and can lead to a complete loss of confidentiality for user accounts.

The vulnerability affects Cisco Webex Meetings when SSO is configured with Control Hub. No specific version information was supplied, so all deployments using this feature are potentially at risk.

The CVSS score of 9.8 indicates a severe, high‑impact risk. An unauthenticated, remote attacker can reach the vulnerable service endpoint. The EPSS value is unavailable, but the lack of remediation in the public KEV list does not reduce the likelihood of exploitation. In practice, an attacker could craft a malicious token, supply it to the endpoint, and immediately impersonate a user without needing any other credentials.