CVE-2026-100532
Received Received - Intake

WhatsApp Login Tool Session Hijack in OpenClaw WhatsApp npm Package

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login and receive a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and causing loss of availability; full account relinking additionally requires the attacker to scan the returned QR code with another phone. The issue affects the owner-only tool boundary rather than WhatsApp transport authentication. Fixed in 2026.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100532
EUVD
EUVD-2026-87518

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw whatsapp to 2026.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100532 is an authentication bypass vulnerability in the @openclaw/whatsapp npm package before version 2026.8.1. The WhatsApp login tool is exposed through a generic channel-tool path without enforcing owner-only restrictions. This allows a non-owner attacker to force a login, receive a new QR code for the configured account, and disconnect the Gateway's WhatsApp account, causing loss of availability.

Detection Guidance

Check npm package versions for @openclaw/whatsapp. Run 'npm list @openclaw/whatsapp' to verify if the installed version is below 2026.8.1. Inspect network logs for unauthorized access attempts to the WhatsApp login tool via generic channel-tool paths.

Impact Analysis

An attacker could exploit this to force a WhatsApp account logout, disconnecting the legitimate user. They would need to scan a QR code with another device to fully relink the account. This results in loss of availability and potential unauthorized account access.

Mitigation Strategies

Upgrade the @openclaw/whatsapp package to version 2026.8.1 or later. Disable the WhatsApp login tool after setup. Restrict agent access to owner-controlled conversations. Avoid exposing tool-capable agents to non-owner senders.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100532. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart