Message spoofing and app state corruption in Baileys (CVE-2026-48063)

Baileys sessions can be sent a malicious payload via the placeholderResendMessage mechanism, triggering a fake `messages.upsert` event with a forged message key and payload, enabling arbitrary message spoofing. The same exploit allows an attacker to corrupt the app state sync system by sending fake key shares and to inject fabricated messages through history sync spoofing. Public POC available. Affected versions: - <7.0.0-rc12 - <6.7.22 We recommend updating to: 7.0.0-rc12, 6.7.22. CVSS 9.3 · our assessment: act_now Reference: https://github.com/WhiskeySockets/Baileys/security/advisories/GHSA-qvv5-jq5g-4cgg Details: https://vuln.today/cve/CVE-2026-48063