CVE-2026-123197

Received Received - Intake

WPPConnect Server Missing Authentication in Static File Access

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description

WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-05

Last Modified

2026-11-05

Generated

2026-11-06

AI Q&A

2026-11-06

EPSS Evaluated

N/A

NVD

CVE-2026-123197

EUVD

EUVD-2026-117642

Affected Vendors & Products

Vendor	Product	Version / Range
wppconnect	wppconnect-server	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-552	The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

Executive Summary

CVE-2026-123197 is a missing authentication vulnerability in WPPConnect Server through version 2.10.76. It allows unauthenticated attackers to access decrypted sticker media files by exploiting an unauthenticated static file mount at /files. Attackers can guess Unix timestamps to enumerate and retrieve stickers from any session, bypassing per-session token checks.

Detection Guidance

To detect this vulnerability, check if the WPPConnect Server is exposing the /files endpoint without authentication. Use curl to test access to sticker files via timestamp-based URLs like GET /files/file<timestamp>.webp. If files are returned without authentication, the system is vulnerable.

Impact Analysis

This vulnerability exposes private sticker media from other WhatsApp sessions. Attackers with network access to the HTTP port can retrieve sensitive sticker content belonging to different accounts. The impact is limited to sticker media disclosure and does not allow write access or session token theft.

Mitigation Strategies

Immediately update WPPConnect Server to the latest version to remove the unauthenticated /files endpoint. Ensure all media access is restricted to authenticated API endpoints like GET /api/:session/get-media-by-message/:messageId or POST /api/:session/download-media.

Hi! I’m here to help you understand CVE-2026-123197. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...