Threats affecting pkg:github/evolution-api

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.9	EPSS 0.4%	CVE-2026-91997evolution-api · Incorrect Comparison Medium6.9EPSS 0.4%2026-09-15CVE Database V5CVE-2026-91997 evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details. EPSS 0.4%Vulnerability evolution-foundation	CVE Database V5	2026-09-15

Page 1 of 1