Threats tagged 'ghsa-cj7j-h23p-3c8m'

WPPConnect Server versions up to 2.10.74 have a missing authentication vulnerability that permits unauthenticated attackers to send WhatsApp messages via the Chatwoot webhook route. This occurs because the verifyToken middleware is not applied, allowing attackers who know or guess a connected session name to post outgoing message bodies and send arbitrary texts or files from that account to any number.