CVE-2026-91161

Name of the Vulnerable Software and Affected Versions OpenWA versions prior to 0.23.5

Description An issue exists where the 'GET /api/sessions/{sessionId}/groups/{groupId}/invite-code' endpoint and the GroupGetInviteCode MCP tool do not require an OPERATOR role. This allows a user with a valid VIEWER key scoped to a session to retrieve an active group invite code. Since the invite code acts as a transferable WhatsApp bearer capability, an external account can use it to join a group administered by the session without needing OpenWA credentials. This grants the external account read and post access to the group, and they remain a member even after the VIEWER key is revoked.

Recommendations Update to version 0.23.5. Restrict the issuance of VIEWER keys to parties who should not be able to add accounts to administered groups, ensuring only OPERATOR and ADMIN access is granted for such actions.