Medium severity5.9NVD Advisory· Published Nov 3, 2026· Updated Nov 3, 2026
CVE-2026-121557
CVE-2026-121557
Description
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.
Affected products
1- Range: <=2.10.74
Patches
Vulnerability mechanics
References
5- github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/controller/deviceController.tsnvd
- github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/routes/index.tsnvd
- github.com/wppconnect-team/wppconnect-server/issues/2701nvd
- github.com/wppconnect-team/wppconnect-server/pull/2702nvd
- www.vulncheck.com/advisories/wppconnect-server-through-2.10.74-missing-authentication-via-api-session-chatwootnvd
News mentions
0No linked articles in our index yet.