Authentication Bypass Vulnerability in WhaTicket Community

CVE-2026-111708

What is CVE-2026-111708?

The WhaTicket Community software contains an authentication bypass vulnerability that enables attackers to register as administrators without proper authentication. By exploiting the /auth/signup endpoint, attackers can send a POST request, potentially leaving the profile field empty or setting it to 'admin'. This allows them unauthorized access to user management features, settings, and all associated tickets, contacts, messages, and WhatsApp connections. It is crucial for users of WhaTicket to implement necessary security measures and updates to mitigate this risk.

References