Missing Authentication in WPPConnect Server for WhatsApp Messaging
CVE-2026-121557

8.2HIGH

Key Information:

Vendor

WPpconnect

Status
WPpconnect-server
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121557?

The WPPConnect Server, specifically version 2.10.74, is vulnerable due to missing authentication controls. This flaw allows unauthenticated attackers to exploit the Chatwoot webhook route by bypassing the verifyToken middleware. If an attacker can deduce or acquire the session name, they can send arbitrary WhatsApp messages or files from the compromised account to any number, posing a significant security risk.

Affected Version(s)

wppconnect-server 0 <= 2.10.74

References

https://github.com/wppconnect-team/wppconnect-server/issu...
issue-tracking
https://github.com/wppconnect-team/wppconnect-server
product
https://github.com/wppconnect-team/wppconnect-server/pull...
patchissue-tracking

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.