« Volver al listado

CVE-2026-91160

Estado: AplazadaAlta (8.2)—

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso a servicio remoto (WebSocket /events) sin autenticación adecuada permite obtener QR de sesión para vincular dispositivos externos y leer/enviar mensajes con privilegios elevados fuera del control de auditoría.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementMulti-factor AuthenticationVulnerability ScanningUser Account ManagementThreat Intelligence ProgramPassword Policies

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Openwa — OpenwaAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-91160",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-91160",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-05T14:53:06.862079Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "rmyndharis",
          "product": "OpenWA",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.23.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-24T17:17:09.257",
  "references": [
    {
      "url": "https://github.com/rmyndharis/OpenWA/commit/acc23c3803c07f43791a92e8e48456572fd69bdc",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rmyndharis/OpenWA/commit/b9d9ea1c57bde98b7833a5d6e482998703667ef0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rmyndharis/OpenWA/pull/1602",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-m427-j4h4-9qwj",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5."
    }
  ],
  "lastModified": "2026-10-05T16:17:17.470",
  "sourceIdentifier": "security-advisories@github.com"
}