Baileys versions before 6.7.22 and 7.0.0-rc12 are vulnerable to an authentication bypass by spoofing via the placeholderResendMessage feature. An attacker can send a crafted payload that triggers a fake messages.upsert event with a forged message key and payload, allowing message spoofing. Additionally, the exploit can corrupt the app state sync system by injecting fake key shares and history sync data, enabling manipulation of previous context or on-demand synchronization. This vulnerability is tracked as CVE-2026-48063 and has a CVSS 4.0 score of 9.3, indicating critical severity. The vulnerability has been addressed in versions 6.7.22 and 7.0.0-rc12.

Successful exploitation allows attackers to spoof WhatsApp messages, corrupt application state synchronization, and inject fake message history. This can lead to misinformation, disruption of app state consistency, and potential trust issues in message authenticity. There is no indication of privilege requirements or user interaction needed, increasing the risk. No known exploits in the wild have been reported.

Upgrade Baileys to version 6.7.22 or later, or to 7.0.0-rc12 or later, where the vulnerability has been fixed. Patch status is confirmed by the vendor advisory stating the fix in these versions. No other mitigation or workaround is indicated.