CVE-2026-91161

MediumCVSS 6.4

Published: 24/09/2026(UTC)Updated: 05/10/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

OpenWA before version 0.23.5 allows a user with a VIEWER key to retrieve a group invite code without the OPERATOR role requirement. The invite code is transferable, so an unauthorized account can join the group, read and post messages, and retain membership after the VIEWER key is revoked.

Risk Assessment

Organizations that issue VIEWER keys to parties who should not add accounts to groups may lose access control, allowing unauthorized individuals to access group content.

Recommendation

Upgrade OpenWA to version 0.23.5 or later to enforce the OPERATOR role requirement for invite code retrieval operations.

Other vulnerabilities in OpenWA

CVE-2026-91160High
In OpenWA before 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through wildcard, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When a session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions.

Original NVD description (English source)

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group invite code. The invite code is a transferable WhatsApp bearer capability, so an external account can join a group administered by the session without an OpenWA credential, gain read and post access to the group, and retain membership after the VIEWER key is revoked. Affected deployments are those that issue VIEWER keys to parties who should not be able to add accounts to administered groups; OPERATOR and ADMIN access is intended. This issue is fixed in version 0.23.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS