Missing Authentication Vulnerability in WPPConnect Server by WPPConnect Team
CVE-2026-123197

6.9MEDIUM

Key Information:

Vendor

WPpconnect

Status
WPpconnect-server
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123197?

The WPPConnect Server version 2.10.76 contains a missing authentication vulnerability that enables unauthenticated attackers to access and read sticker media files. By sending GET requests with Unix timestamps in the format /files/file.webp, attackers can bypass session-specific token checks and retrieve sticker media associated with other user sessions. This flaw poses a risk of unauthorized information disclosure, accentuating the need for immediate attention and remediation.

Affected Version(s)

wppconnect-server 0 <= 2.10.76

References

https://github.com/wppconnect-team/wppconnect-server/issu...
issue-tracking
https://github.com/wppconnect-team/wppconnect-server/pull...
patchissue-tracking
https://github.com/wppconnect-team/wppconnect-server/comm...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
joaosouz4dev
.