---
id: "CVE-2025-55177"
kind: "vulnerability"
aliases: ["CVE-2025-55177"]
title: "Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73,\u2026"
severity: "medium"
cvss: 5.4
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Meta Platforms WhatsApp", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "whatsapp", "fixed": ["2.25.21.73"], "affected": ">= 2.22.25.2, < 2.25.21.73", "ecosystem": "vendor"}, {"name": "whatsapp", "fixed": ["2.25.21.78"], "affected": ">= 2.22.25.2, < 2.25.21.78", "ecosystem": "vendor"}, {"name": "whatsapp business", "fixed": ["2.25.21.78"], "affected": ">= 2.22.25.2, < 2.25.21.78", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["end-users", "exploited", "linked-devices", "vendor", "whatsapp"]
not_affected_if: ["unknown"]
published_at: "2025-08-29T16:15:36+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-55177", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55177", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73,…

WhatsApp fails to fully check authorization on synchronization messages sent to linked devices. An unrelated user can make a target's device process content fetched from an arbitrary URL.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Meta Platforms WhatsApp affected ? fixed ?
- vendor:whatsapp affected >= 2.22.25.2, < 2.25.21.73 fixed 2.25.21.73
- vendor:whatsapp affected >= 2.22.25.2, < 2.25.21.78 fixed 2.25.21.78
- vendor:whatsapp business affected >= 2.22.25.2, < 2.25.21.78 fixed 2.25.21.78

## Fix

Apply the vendor mitigations from Meta; update WhatsApp on all linked devices to the current release. Exact fixed versions are unknown from the sources.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-55177
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-55177

## From the sources

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_