Live › vulnerability › CVE-2026-121557
WPPConnect Server through 2.10.74 exposes a Chatwoot webhook route that skips its token check. An unauthenticated attacker who knows or guesses a connected session name can send arbitrary text or files from that WhatsApp account to any number.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Teams that self-host WPPConnect Server (npm wppconnect-server) up to and including 2.10.74, typically as a WhatsApp gateway for Chatwoot or bots. An attacker who can reach the server over the network and knows or guesses the name of a connected session can send text or files from that WhatsApp account to any number, with no token. Servers that are not reachable from untrusted networks, or whose /api/:session/chatwoot route is blocked at a proxy, have much less exposure. The sources do not say whether the route is enabled by default.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| wppconnect-server | npm | <= 2.10.74 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.
This page as .md · .json · in your agent: get_signal("CVE-2026-121557")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.