CVE-2026-91160

Name of the Vulnerable Software and Affected Versions OpenWA versions prior to 0.23.5

Description The /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through a wildcard subscription, bypassing the OPERATOR role requirement normally enforced for the GET /api/sessions/{sessionId}/qr endpoint. If a session is waiting to be paired, an attacker with a VIEWER key can use the exposed QR code to link an external device to the WhatsApp account, enabling them to read and send messages outside the system and its audit trail. This does not affect keys restricted via allowedSessions or deployments using only OPERATOR or ADMIN keys.

Recommendations Update to version 0.23.5.