This vulnerability arises from improper certificate validation in the SSO integration with Cisco Webex Control Hub, enabling an unauthenticated remote attacker to impersonate any user by connecting to a service endpoint and providing a crafted token. Successful exploitation could lead to unauthorized access to legitimate Cisco Webex services. The issue affects a wide range of Cisco Webex Meetings versions. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker exploiting this vulnerability could gain unauthorized access to Cisco Webex services by impersonating any user, potentially compromising sensitive communications and data confidentiality, integrity, and availability within the affected service. The critical CVSS score of 9.8 reflects the severity of this impact. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is released by Cisco, organizations should monitor Cisco's security advisories closely. No specific temporary mitigations are provided in the available data.