Message Spoofing Vulnerability in Baileys API for WhatsApp Web
CVE-2026-48063

9.3CRITICAL

Key Information:

Vendor

Whiskeysockets

Status
Baileys
@whiskeysockets/baileys
Vendor
CVE Published:
3 August 2026

What is CVE-2026-48063?

The Baileys API for WhatsApp Web has a vulnerability that allows an attacker to send malicious payloads through the placeholderResendMessage feature. In affected versions, this could lead to spoofing of messages and can disrupt the app's state synchronization by injecting fake key shares. Attackers can also manipulate the history synchronization process to present fabricated previous contexts, making it imperative for users to update to versions 6.7.22 or 7.0.0-rc12 to mitigate these risks.

Affected Version(s)

@whiskeysockets/baileys < 6.7.22 < 6.7.22

@whiskeysockets/baileys >= 7.0.0-rc.1, < 7.0.0-rc12 < 7.0.0-rc.1, 7.0.0-rc12

Baileys < 6.7.22 < 6.7.22

References

https://github.com/WhiskeySockets/Baileys/security/adviso...
x_refsource_CONFIRM
https://github.com/WhiskeySockets/Baileys/commit/3beb08ee...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.