CVE-2026-48063: CWE-290: Authentication Bypass by Spoofing in WhiskeySockets Baileys
CVE-2026-48063 is a critical authentication bypass vulnerability in WhiskeySockets Baileys, a socket-based TypeScript/JavaScript API for WhatsApp Web. Versions prior to 6.7.22 and 7.0.0-rc12 are affected. The flaw allows an attacker to send malicious payloads that spoof messages, corrupt app state synchronization, and inject fake historical context. This can lead to unauthorized message spoofing and manipulation of sync data. The issue has been fixed in versions 6.7.22 and 7.0.0-rc12.
AI Analysis
Technical Summary
This vulnerability in Baileys enables an attacker to exploit the placeholderResendMessage feature to trigger fake messages.upsert events with forged message keys and payloads. This allows message spoofing and corruption of the app state sync system through fake key shares and history sync spoofing. The vulnerability affects all Baileys sessions in versions prior to 6.7.22 and 7.0.0-rc12. The flaw is categorized under CWE-290 (Authentication Bypass), CWE-345 (Insufficient Verification of Data Authenticity), and CWE-346 (Origin Validation Error). The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity. No official remediation level or patch links are provided in the source data, but the description states the issue is fixed in versions 6.7.22 and 7.0.0-rc12.
Potential Impact
An attacker can spoof messages in Baileys sessions, corrupt the app state synchronization, and inject fake historical sync data. This compromises the integrity and authenticity of messages and synchronization state, potentially misleading users and applications relying on Baileys for WhatsApp Web interactions. The vulnerability does not require privileges or user interaction, increasing its risk.
Mitigation Recommendations
The vulnerability has been fixed in Baileys versions 6.7.22 and 7.0.0-rc12. Users and administrators should upgrade to at least these versions to remediate the issue. Patch status is confirmed by the vendor's versioning information in the description. No additional vendor advisory content is available, so check official WhiskeySockets communications for further updates.
CVE-2026-48063: CWE-290: Authentication Bypass by Spoofing in WhiskeySockets Baileys
Description
CVE-2026-48063 is a critical authentication bypass vulnerability in WhiskeySockets Baileys, a socket-based TypeScript/JavaScript API for WhatsApp Web. Versions prior to 6.7.22 and 7.0.0-rc12 are affected. The flaw allows an attacker to send malicious payloads that spoof messages, corrupt app state synchronization, and inject fake historical context. This can lead to unauthorized message spoofing and manipulation of sync data. The issue has been fixed in versions 6.7.22 and 7.0.0-rc12.
CVSS v4.0
Score 9.3critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Baileys enables an attacker to exploit the placeholderResendMessage feature to trigger fake messages.upsert events with forged message keys and payloads. This allows message spoofing and corruption of the app state sync system through fake key shares and history sync spoofing. The vulnerability affects all Baileys sessions in versions prior to 6.7.22 and 7.0.0-rc12. The flaw is categorized under CWE-290 (Authentication Bypass), CWE-345 (Insufficient Verification of Data Authenticity), and CWE-346 (Origin Validation Error). The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity. No official remediation level or patch links are provided in the source data, but the description states the issue is fixed in versions 6.7.22 and 7.0.0-rc12.
Potential Impact
An attacker can spoof messages in Baileys sessions, corrupt the app state synchronization, and inject fake historical sync data. This compromises the integrity and authenticity of messages and synchronization state, potentially misleading users and applications relying on Baileys for WhatsApp Web interactions. The vulnerability does not require privileges or user interaction, increasing its risk.
Mitigation Recommendations
The vulnerability has been fixed in Baileys versions 6.7.22 and 7.0.0-rc12. Users and administrators should upgrade to at least these versions to remediate the issue. Patch status is confirmed by the vendor's versioning information in the description. No additional vendor advisory content is available, so check official WhiskeySockets communications for further updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T18:25:25.707Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7105c0bf32cb7a3436d795
Added to database: 08/03/2026, 21:18:56 UTC
Last enriched: 08/03/2026, 21:48:01 UTC
Last updated: 08/04/2026, 01:27:38 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.