CVE-2026-121557 in WPPConnect Server
Summary
by MITRE • 11/03/2026
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The WPPConnect Server, specifically in versions up through 2.10.74, suffers from a critical missing authentication vulnerability within its webhook integration layer. This flaw stems from the improper implementation of access controls on the Chatwoot webhook route, which is designed to facilitate communication between WhatsApp and customer support platforms like Chatwoot. The core technical deficiency lies in the absence or misconfiguration of the verifyToken middleware for this specific endpoint. In a secure architecture, such middleware serves as a gatekeeper, validating incoming requests against a pre-shared secret token to ensure that only authorized systems can trigger actions on behalf of connected WhatsApp sessions. Without this verification step, the server fails to distinguish between legitimate administrative commands and malicious requests from unauthenticated external actors.
This architectural oversight allows attackers who possess knowledge or are able to guess the name of an active session within the WPPConnect instance to exploit the endpoint directly. By sending a POST request to the vulnerable webhook route, an attacker can bypass all authentication mechanisms entirely. The vulnerability effectively grants remote code execution capabilities in the context of the WhatsApp account associated with that specific session identifier. Since the server processes these requests without verifying their origin or authenticity, it blindly executes the instructions contained within the payload, treating them as valid administrative commands from a trusted source.
The operational impact of this vulnerability is severe and multifaceted. An attacker can send arbitrary text messages or files to any recipient number using the compromised WhatsApp account. This capability transforms the vulnerable instance into a tool for spamming, phishing, or social engineering attacks at scale. The ability to send media files further exacerbates the risk, as attackers could distribute malware links or malicious documents disguised as legitimate content from a trusted contact. Furthermore, because the attacker can target any number, they are not limited by the existing contacts of the victim, allowing for broad dissemination of harmful content and significant reputational damage to both the individual user and potentially the organization if the account is business-related.
From an industry standards perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, specifically where a system fails to verify identity before performing sensitive actions. It also relates closely to CWE-306, Missing Authentication for Critical Function, as the webhook route performs critical state-changing operations without requiring proof of authority. In terms of threat modeling and attack patterns, this scenario maps directly to MITRE ATT&CK technique T1598.002, Phishing via Spearheading, where an attacker uses compromised credentials or trusted channels to send malicious content. Additionally, the exploitation method falls under T1496, Resource Hijacking, as the attacker utilizes the victim's resources (WhatsApp account and bandwidth) for their own purposes without authorization.
To mitigate this vulnerability, immediate action is required by upgrading WPPConnect Server to a version that includes proper authentication checks on all webhook endpoints. Administrators must ensure that the verifyToken middleware is correctly applied to the Chatwoot route and other sensitive API paths. It is also recommended to implement additional security controls such as IP whitelisting for webhook sources, using strong, randomly generated tokens that are not guessable, and enabling rate limiting to prevent abuse even if authentication fails. Regular audits of endpoint configurations against industry best practices for secure web application development will help prevent similar misconfigurations in the future.