CVE-2026-91160: CWE-862: Missing Authorization in rmyndharis OpenWA
OpenWA versions prior to 0.23.5 have a missing authorization vulnerability in the /events WebSocket gateway. This flaw allows a VIEWER API key to receive the session.qr event, which should require OPERATOR role authorization. The exposed QR code can be used to link an external device to the WhatsApp account, enabling message reading and sending outside OpenWA's control and audit trail. Deployments issuing only OPERATOR or ADMIN keys are not affected. The issue is fixed in version 0.23.5.
AI Analysis
Technical Summary
CVE-2026-91160 is a missing authorization vulnerability (CWE-862) in the OpenWA WhatsApp API gateway before version 0.23.5. The /events WebSocket gateway improperly delivers the session.qr event to VIEWER API keys, which should not have access to this event as GET /api/sessions/{sessionId}/qr requires OPERATOR role. This allows an attacker with a VIEWER key to obtain the QR code used for pairing external devices, potentially linking unauthorized devices to the WhatsApp account and bypassing OpenWA's audit controls. The vulnerability is resolved in OpenWA 0.23.5.
Potential Impact
An attacker with a VIEWER API key can obtain the QR code for pairing external devices to a WhatsApp session, enabling them to read and send messages outside OpenWA's monitoring and audit trail. This compromises confidentiality and integrity of WhatsApp communications managed by OpenWA. Deployments that restrict keys to OPERATOR or ADMIN roles or use allowedSessions restrictions are not affected.
Mitigation Recommendations
Upgrade OpenWA to version 0.23.5 or later, where this authorization issue is fixed. Deployments should ensure API keys are assigned appropriate roles, avoiding use of VIEWER keys where OPERATOR or ADMIN roles are required. No additional mitigation is necessary once upgraded.
CVE-2026-91160: CWE-862: Missing Authorization in rmyndharis OpenWA
Description
OpenWA versions prior to 0.23.5 have a missing authorization vulnerability in the /events WebSocket gateway. This flaw allows a VIEWER API key to receive the session.qr event, which should require OPERATOR role authorization. The exposed QR code can be used to link an external device to the WhatsApp account, enabling message reading and sending outside OpenWA's control and audit trail. Deployments issuing only OPERATOR or ADMIN keys are not affected. The issue is fixed in version 0.23.5.
CVSS v3.1
Score 8.2high
Affected software
rmyndharis
OpenWA
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-91160 is a missing authorization vulnerability (CWE-862) in the OpenWA WhatsApp API gateway before version 0.23.5. The /events WebSocket gateway improperly delivers the session.qr event to VIEWER API keys, which should not have access to this event as GET /api/sessions/{sessionId}/qr requires OPERATOR role. This allows an attacker with a VIEWER key to obtain the QR code used for pairing external devices, potentially linking unauthorized devices to the WhatsApp account and bypassing OpenWA's audit controls. The vulnerability is resolved in OpenWA 0.23.5.
Potential Impact
An attacker with a VIEWER API key can obtain the QR code for pairing external devices to a WhatsApp session, enabling them to read and send messages outside OpenWA's monitoring and audit trail. This compromises confidentiality and integrity of WhatsApp communications managed by OpenWA. Deployments that restrict keys to OPERATOR or ADMIN roles or use allowedSessions restrictions are not affected.
Mitigation Recommendations
Upgrade OpenWA to version 0.23.5 or later, where this authorization issue is fixed. Deployments should ensure API keys are assigned appropriate roles, avoiding use of VIEWER keys where OPERATOR or ADMIN roles are required. No additional mitigation is necessary once upgraded.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-14T21:20:41.196Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab5545bf7a7c5410690de36
Added to database: 09/24/2026, 16:48:27 UTC
Last enriched: 09/24/2026, 17:02:56 UTC
Last updated: 09/24/2026, 17:13:52 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.