What’s Vulnerable › Vulnerabilities

CVE-2026-91160: OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-24 · updated 2026-10-05
• Weakness: CWE-862

Description

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5.

Affected products

• rmyndharis OpenWA: before 0.23.5

References

• https://github.com/rmyndharis/OpenWA/commit/acc23c3803c07f43791a92e8e48456572fd69bdc
• https://github.com/rmyndharis/OpenWA/commit/b9d9ea1c57bde98b7833a5d6e482998703667ef0
• https://github.com/rmyndharis/OpenWA/pull/1602
• https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5
• https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-m427-j4h4-9qwj

Get alerted when CVE-2026-91160 or the next vulnerability affects your stack