Threats affecting pkg:github/rmyndharis/OpenWA

OpenWA versions prior to 0.23.5 contain an authorization flaw in the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and the GroupGetInviteCode MCP tool. These endpoints lack the required OPERATOR role check, allowing users with a VIEWER key scoped to a session to retrieve active group invite codes. Since invite codes allow joining WhatsApp groups, unauthorized users can join groups, gain read and post access, and maintain membership even after VIEWER key revocation. The issue is fixed in version 0.23.5.

OpenWA versions prior to 0.23.5 contain a missing authorization vulnerability in the /events WebSocket gateway. This flaw allows a VIEWER API key to receive the session.qr event, which should be restricted to OPERATOR role keys. The exposed QR code can be used to link an external device to the WhatsApp account, enabling message reading and sending outside OpenWA's audit trail. Deployments issuing only OPERATOR or ADMIN keys are not affected. The issue is fixed in version 0.23.5.