CVE-2026-91160

HighCVSS 8.2

Published: 24/09/2026(UTC)Updated: 05/10/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

In OpenWA before 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through wildcard, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When a session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions.

Risk Assessment

A holder of a VIEWER key can gain access to a WhatsApp account, take over the session, and send messages without audit traces, potentially leading to data leaks or abuse.

Recommendation

Update OpenWA to 0.23.5. Regularly review issued API keys and consider restricting VIEWER permissions.

Other vulnerabilities in OpenWA

CVE-2026-91161Medium
OpenWA before version 0.23.5 allows a user with a VIEWER key to retrieve a group invite code without the OPERATOR role requirement. The invite code is transferable, so an unauthorized account can join the group, read and post messages, and retain membership after the VIEWER key is revoked.

Original NVD description (English source)

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS