CVE-2026-91161

Deferred Deferred - Pending Action

Unauthorized Group Access via Invite Code in OpenWA

Publication date: 2026-09-24

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group invite code. The invite code is a transferable WhatsApp bearer capability, so an external account can join a group administered by the session without an OpenWA credential, gain read and post access to the group, and retain membership after the VIEWER key is revoked. Affected deployments are those that issue VIEWER keys to parties who should not be able to add accounts to administered groups; OPERATOR and ADMIN access is intended. This issue is fixed in version 0.23.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-05

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-91161

EUVD

EUVD-2026-86295

Affected Vendors & Products

Vendor	Product	Version / Range
openwa	whatsapp_api_gateway	to 0.23.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects OpenWA, a self-hosted WhatsApp API gateway. It allows users with a VIEWER role to retrieve group invite codes without proper authorization. These codes act as bearer credentials, enabling anyone with the link to join a WhatsApp group without needing OpenWA credentials. The issue was fixed in version 0.23.5 by requiring the OPERATOR role to access invite codes.

Detection Guidance

To detect this vulnerability, check if your OpenWA instance is running a version prior to 0.23.5. Use commands like 'curl -X GET http://<openwa-server>/api/sessions/{sessionId}/groups/{groupId}/invite-code' with a VIEWER key to see if it returns an invite code without requiring OPERATOR role.

Impact Analysis

Unauthorized users could join private WhatsApp groups by obtaining invite codes through VIEWER keys. This grants them read and post access to group content. Even after revoking the VIEWER key, the unauthorized user retains group membership. The vulnerability primarily affects deployments that issue VIEWER keys to untrusted parties.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to WhatsApp groups through exposed invite codes. Unauthorized group membership may lead to data exposure or privacy violations if sensitive information is shared in those groups. Organizations using OpenWA must ensure proper access controls are enforced to protect user data and maintain compliance.

Mitigation Strategies

Immediately upgrade OpenWA to version 0.23.5 or later. Revoke all VIEWER keys held by untrusted parties and reset invite links for any compromised groups to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-91161. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70