Medium severity5.8NVD Advisory· Published Sep 12, 2024· Updated Jun 17, 2026
CVE-2024-45607
CVE-2024-45607
Description
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
whatsapp-api-jsnpm | >= 4.0.0, < 4.0.3 | 4.0.3 |
Affected products
3>= 4.0.0, < 4.0.3+ 1 more
- (no CPE)range: >= 4.0.0, < 4.0.3
- cpe:2.3:a:secreto31126:whatsapp-api-js:*:*:*:*:*:node.js:*:*range: >=4.0.0,<4.0.3
Patches
Vulnerability mechanics
References
5- github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6dnvdPatchWEB
- github.com/Secreto31126/whatsapp-api-js/pull/371nvdPatchWEB
- github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-mwhf-vhr5-7j23ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-45607ghsaADVISORY
News mentions
0No linked articles in our index yet.