CVE-2026-100532

Deferred Deferred - Pending Action

WhatsApp Login Tool Session Hijack in OpenClaw WhatsApp npm Package

Publication date: 2026-09-26

Last updated on: 2026-10-08

Assigner: VulnCheck

Description

@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login and receive a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and causing loss of availability; full account relinking additionally requires the attacker to scan the returned QR code with another phone. The issue affects the owner-only tool boundary rather than WhatsApp transport authentication. Fixed in 2026.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-26

Last Modified

2026-10-08

Generated

2026-10-16

AI Q&A

2026-09-26

EPSS Evaluated

2026-10-14

NVD

CVE-2026-100532

EUVD

EUVD-2026-87518

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	whatsapp	to 2026.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-100532 is an authentication bypass vulnerability in the @openclaw/whatsapp npm package before version 2026.8.1. The WhatsApp login tool is exposed through a generic channel-tool path without enforcing owner-only restrictions. This allows a non-owner attacker to force a login, receive a new QR code for the configured account, and disconnect the Gateway's WhatsApp account, causing loss of availability.

Detection Guidance

Check npm package versions for @openclaw/whatsapp. Run 'npm list @openclaw/whatsapp' to verify if the installed version is below 2026.8.1. Inspect network logs for unauthorized access attempts to the WhatsApp login tool via generic channel-tool paths.

Impact Analysis

An attacker could exploit this to force a WhatsApp account logout, disconnecting the legitimate user. They would need to scan a QR code with another device to fully relink the account. This results in loss of availability and potential unauthorized account access.

Compliance Impact

This vulnerability primarily impacts availability and integrity of WhatsApp accounts rather than confidentiality, so it does not directly violate GDPR or HIPAA data protection requirements. However, unauthorized account access could lead to data exposure or service disruption, potentially violating compliance if sensitive communications are interrupted or compromised.

Mitigation Strategies

Upgrade the @openclaw/whatsapp package to version 2026.8.1 or later. Disable the WhatsApp login tool after setup. Restrict agent access to owner-controlled conversations. Avoid exposing tool-capable agents to non-owner senders.

Hi! I’m here to help you understand CVE-2026-100532. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70