CVE-2026-91160

Deferred Deferred - Pending Action

WebSocket QR Code Exposure in OpenWA

Publication date: 2026-09-24

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-05

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-91160

EUVD

EUVD-2026-86293

Affected Vendors & Products

Vendor	Product	Version / Range
openwa	whatsapp_api_gateway	to 0.23.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenWA (CVE-2026-91160) involves improper access control in the /events WebSocket gateway. It allowed VIEWER role API keys to receive session pairing QR codes via WebSocket events, even though the REST API endpoint for QR codes requires an OPERATOR role. This exposed QR codes to unauthorized users who could then link their devices to WhatsApp accounts and access messages outside OpenWA's audit trail.

Detection Guidance

To detect this vulnerability, check OpenWA logs for unauthorized QR code events delivered to VIEWER role keys. Monitor WebSocket connections for session.qr broadcasts to non-OPERATOR roles. Verify API key roles and ensure no VIEWER keys are receiving QR data.

Impact Analysis

If you use OpenWA versions 0.23.4 or earlier with VIEWER role keys, an attacker with access to such a key could receive QR codes for active sessions. Scanning these QR codes links their device to your WhatsApp account, allowing them to read and send messages without your knowledge. This bypasses OpenWA's audit trail and compromises message confidentiality and integrity.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access controls. It exposes WhatsApp messages to unauthorized access, potentially breaching GDPR's confidentiality principles and HIPAA's safeguards for protected health information. Organizations using OpenWA must upgrade to version 0.23.5 to restore proper access controls and maintain compliance.

Mitigation Strategies

Upgrade OpenWA to version 0.23.5 or later. Review and revoke any VIEWER role API keys issued to untrusted parties. Ensure all API keys follow the principle of least privilege. Monitor for suspicious device pairings in WhatsApp accounts.

Hi! I’m here to help you understand CVE-2026-91160. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70