Authentication Bypass in Google Cloud Dialogflow CX Messenger
CVE-2025-13427

6.9MEDIUM

Key Information:

Vendor

Google Cloud

Status
Dialogflow Cx Messenger
Vendor
CVE Published:
18 December 2025

What is CVE-2025-13427?

An authentication bypass vulnerability discovered in Google Cloud Dialogflow CX Messenger allowed unauthorized users to interact with restricted chat agents. By manipulating initialization parameters or crafting specific API requests, these users gained unauthorized access to sensitive knowledge and could trigger various intents within the chat agents. All versions released after August 20, 2025, include protections against this security flaw, ensuring that users do not need to take additional action.

Affected Version(s)

Dialogflow CX Messenger 0 <= 2025-08-20

References

https://docs.cloud.google.com/dialogflow/docs/release-not...
release-notes

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

asterfiester
JSON
.
CVE-2025-13427 : Authentication Bypass in Google Cloud Dialogflow CX Messenger