CVE-2026-91160 in OpenWA
Summary
by MITRE • 09/24/2026
OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in versions of OpenWA prior to 0.23.5 represents a critical authorization bypass within the application's WebSocket event gateway, specifically affecting the session.qr event delivery mechanism. OpenWA functions as an open-source, self-hosted API gateway for WhatsApp, relying on a role-based access control model that distinguishes between OPERATOR and VIEWER roles to manage permissions. The core technical flaw lies in the inconsistency of permission enforcement across different endpoints handling QR code generation. While the RESTful endpoint GET /api/sessions/{sessionId}/qr correctly enforces an OPERATOR role requirement for accessing session-specific QR codes, the WebSocket gateway at /events erroneously delivers the same sensitive session.qr event to clients holding only a VIEWER API key. This discrepancy arises because the WebSocket subscription logic allows viewers to subscribe to events by name or via wildcard patterns without adequately validating whether the specific event payload requires higher-level privileges than those granted to the viewer role.
From an operational perspective, this misconfiguration has severe security implications for organizations deploying OpenWA. When a WhatsApp session is in a pending state awaiting pairing with a new device, it generates a QR code that serves as the authentication token for linking external devices to the account. Because VIEWER keys can access these QR codes through the WebSocket gateway, an attacker or unauthorized internal user possessing such a key can capture the QR image and use it to pair their own WhatsApp client with the target account. This action effectively grants the attacker full control over the session, allowing them to read incoming messages and send outgoing communications on behalf of the legitimate account owner. Crucially, this activity occurs outside the scope of OpenWA's native audit trail, meaning that unauthorized access and message interception remain undetected by standard logging mechanisms designed for OPERATOR activities.
The impact is further exacerbated by the fact that WhatsApp sessions are often used for business-critical communications or personal data exchange. An attacker leveraging this vulnerability can perform social engineering attacks using the compromised account's trusted identity, potentially leading to financial fraud, reputation damage, or extraction of sensitive information. Although the vulnerability does not affect deployments where only OPERATOR or ADMIN keys are issued, nor does it allow access beyond sessions explicitly allowed for a specific key, the existence of VIEWER roles in many configurations creates a significant attack surface. The restriction on allowedSessions limits lateral movement to pre-approved sessions but fails to mitigate the risk of initial compromise through QR code interception within those permitted boundaries.
To remediate this vulnerability, organizations must upgrade OpenWA to version 0.23.5 or later, where the WebSocket gateway has been patched to enforce consistent role-based access controls for all session-related events. In addition to upgrading, administrators should review their API key distribution policies to ensure that VIEWER keys are issued only when strictly necessary and with minimal scope. Implementing strict monitoring of WebSocket connections and QR code generation attempts can provide additional visibility into potential abuse. This issue is categorized under CWE-269, which addresses Improper Privilege Management, as the application failed to enforce appropriate authorization levels for a specific action. Furthermore, it aligns with MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of using legitimate credentials to gain unauthorized access and establish persistence through device pairing, bypassing traditional authentication controls by exploiting weak session management practices.