EUVD-2026-86293Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv VIEWER API key
-
DeliverySubscribe to /events WebSocket by name or wildcard
-
ExploitReceive leaked session.qr for pairing session
-
ExecutionScan QR to link external device
-
ImpactRead and send WhatsApp messages outside audit trail
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) the deployment issues VIEWER-role API keys (deployments using only OPERATOR/ADMIN keys are explicitly not affected); (2) the attacker's VIEWER key is authorized for the target session (keys narrowed via allowedSessions stay limited to their sessions); and (3) the target session is in the pairing/waiting-to-be-linked state so a session.qr event is emitted - a transient window that drives the AC:H rating. The attacker subscribes to the /events WebSocket gateway either by explicit event name or via either wildcard subscription form. Limiting factors: valid VIEWER credentials are needed (PR:L, not unauthenticated), the pairing QR is only valid during active pairing, and non-default key issuance policies (OPERATOR/ADMIN only) fully mitigate the issue. |
| Impact | The CVSS 3.1 base score is 8.2 (High) with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, meaning network-reachable but with high attack complexity and requiring a low-privilege (VIEWER) API key. The high complexity (AC:H) is well-justified: the flaw only exposes the QR when an allowed session is actively in the pairing/waiting state, so exploitation depends on hitting that transient window. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input - so there is no signal of active or automatable exploitation, only vendor/GitHub-advisory disclosure (GHSA-m427-j4h4-9qwj) with a source-verified fix. This is best characterized as a real but conditional access-control gap rather than a mass-exploitation threat: the impact ceiling is severe (full read/send of WhatsApp messages outside the audit trail, hence C:H/I:H and scope change), but it is gated on the deployment actually issuing VIEWER-tier keys, the key having access to the target session, and the session being in a pairing state. Deployments that issue only OPERATOR/ADMIN keys are unaffected. Overall: moderate real-world priority, high potential impact, low likelihood of opportunistic mass exploitation. |
| Exploit ScenarioDerived | An attacker holding a low-privileged VIEWER API key (or an insider given read-only access) subscribes to the /events WebSocket gateway by event name or wildcard and waits for an allowed session to enter the pairing state. The leaked session.qr event lets them scan the pairing QR with their own device, linking it to the victim's WhatsApp account and silently reading and sending messages outside OpenWA's audit trail. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
An authorization gap in OpenWA before 0.23.5 allows a low-privilege VIEWER API key to receive the session.qr pairing event over the /events WebSocket gateway, even though the equivalent REST endpoint GET /api/sessions/{sessionId}/qr enforces the OPERATOR role. When a session is in the waiting-to-be-paired state, the leaked QR code lets the key holder link an external device to the linked WhatsApp account, after which they can read and send messages outside OpenWA and outside its audit trail. Exploitation is authenticated (CVSS PR:L) and gated by a transient pairing window that drives the high attack-complexity rating (AC:H); no public exploit code identified at time of analysis. Vendor-released patch: 0.23.5.
RemediationAI
Upgrade OpenWA to 0.23.5, the exact vendor-released fixed version (release tag v0.23.5), which restores the OPERATOR role requirement on the session.qr WebSocket event to match GET /api/sessions/{sessionId}/qr; the upstream fix is tracked in pull request rmyndharis/OpenWA#1602 and commits acc23c3803c07f43791a92e8e48456572fd69bdc and b9d9ea1c57bde98b7833a5d6e482998703667ef0, with the vendor advisory at https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-m427-j4h4-9qwj. Until upgrading, the most complete compensating control is to stop issuing VIEWER-role API keys entirely and restrict key issuance to OPERATOR/ADMIN only, which the advisory states fully mitigates the issue; because this changes the client integration model, any automation relying on read-only keys must be re-provisioned with elevated roles and monitored accordingly. Where VIEWER keys cannot be eliminated, narrow each key with allowedSessions to the minimum set of sessions it legitimately needs, accepting the residual risk that a key still receives the QR for any authorized session that enters pairing. A further option is to block or disable WebSocket subscriptions to session.qr at the gateway or at a network reverse proxy for non-privileged consumers, at the cost of losing real-time pairing visibility for those clients. Because the leaked QR is a pairing credential, treat any session queued for pairing while untrusted VIEWER keys existed as potentially compromised and unlink unknown devices from the WhatsApp account before re-pairing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenWA is a self-hosted WhatsApp API gateway built on NestJS and Socket.IO that exposes both a REST API and a WebSocket event gateway under /events. Clients authenticate to the gateway with an API key that carries a role (VIEWER, OPERATOR, or ADMIN) and an optional allowedSessions allowlist; sockets subscribe to events either by explicit event name or through two wildcard subscription forms. The root cause is CWE-862 (Missing Authorization): the role check enforced on the REST endpoint GET /api/sessions/{sessionId}/qr was never applied to the equivalent server-push path, so the session.qr broadcast was fanned out to every socket in the session room regardless of role. Because session.qr is effectively a pairing credential rather than ordinary telemetry, delivering it to a VIEWER key bypasses the intended privileged boundary and produces cross-boundary impact (S:C) with high confidentiality and integrity loss on the WhatsApp account. The CPE cpe:2.3:a:rmyndharis:openwa:*:*:*:*:*:*:*:* indicates all releases prior to the fix are in scope. The upstream fix introduces a QR_DENIED_ROOM and excludes that room from the session.qr fan-out, re-validating the key's role on each subscribe so a key downgraded to VIEWER stops receiving the QR from its next subscribe and role changes disconnect its sockets.
Know when Openwa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Network WebSocket delivery (AV:N) with a valid VIEWER key (PR:L); AC:H because a session must be in the transient pairing state; scope change (S:C) as the linked WhatsApp account is a separate system compromised for read/send (C:H/I:H), no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5.
Technical POC Analysis
Evidence note: the supplied material is the GitHub advisory (GHSA-m427-j4h4-9qwj) plus the CVE summary only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
OpenWA deployments running versions before 0.23.5 allow a low-privilege VIEWER API key to capture a session pairing QR code through the events WebSocket gateway, which can be used to bind an unauthorized external device to a linked WhatsApp account. The attacker can then read and send messages on that account entirely outside OpenWA and outside the organization's audit trail, so the breach is both a confidentiality loss and a visibility loss that may prevent detection and forensic reconstruction. Any business unit relying on OpenWA to manage corporate WhatsApp communications, and any compliance obligation tied to message retention or oversight, is directly in scope.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB