Openwa
Monthly
An authorization gap in OpenWA before 0.23.5 allows a low-privilege VIEWER API key to receive the `session.qr` pairing event over the /events WebSocket gateway, even though the equivalent REST endpoint GET /api/sessions/{sessionId}/qr enforces the OPERATOR role. When a session is in the waiting-to-be-paired state, the leaked QR code lets the key holder link an external device to the linked WhatsApp account, after which they can read and send messages outside OpenWA and outside its audit trail. Exploitation is authenticated (CVSS PR:L) and gated by a transient pairing window that drives the high attack-complexity rating (AC:H); no public exploit code identified at time of analysis. Vendor-released patch: 0.23.5.
Incorrect authorization in OpenWA before 0.23.5 lets any caller holding a valid VIEWER-role API key retrieve a group's active invite code through the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code REST endpoint or the equivalent GroupGetInviteCode MCP tool, which enforce no OPERATOR role requirement. Because a WhatsApp invite code is a transferable bearer capability rather than plain read data, an external account can use the leaked code to join a group administered by the session, obtain read and post access, and keep that membership even after the VIEWER key is revoked. The flaw (CWE-863) is a broken-authorization issue rather than a remote-code-execution bug, CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), requires the victim session to have a started engine and an administered group with an existing invite code, and is only practically dangerous in deployments that hand VIEWER keys to parties who should not be able to add accounts to those groups. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the vendor released a patch in version 0.23.5.
An authorization gap in OpenWA before 0.23.5 allows a low-privilege VIEWER API key to receive the `session.qr` pairing event over the /events WebSocket gateway, even though the equivalent REST endpoint GET /api/sessions/{sessionId}/qr enforces the OPERATOR role. When a session is in the waiting-to-be-paired state, the leaked QR code lets the key holder link an external device to the linked WhatsApp account, after which they can read and send messages outside OpenWA and outside its audit trail. Exploitation is authenticated (CVSS PR:L) and gated by a transient pairing window that drives the high attack-complexity rating (AC:H); no public exploit code identified at time of analysis. Vendor-released patch: 0.23.5.
Incorrect authorization in OpenWA before 0.23.5 lets any caller holding a valid VIEWER-role API key retrieve a group's active invite code through the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code REST endpoint or the equivalent GroupGetInviteCode MCP tool, which enforce no OPERATOR role requirement. Because a WhatsApp invite code is a transferable bearer capability rather than plain read data, an external account can use the leaked code to join a group administered by the session, obtain read and post access, and keep that membership even after the VIEWER key is revoked. The flaw (CWE-863) is a broken-authorization issue rather than a remote-code-execution bug, CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), requires the victim session to have a started engine and an administered group with an existing invite code, and is only practically dangerous in deployments that hand VIEWER keys to parties who should not be able to add accounts to those groups. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the vendor released a patch in version 0.23.5.