CVE-2026-121557

EUVD-2026-115902
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/wppconnect-team/wppconnect-server
https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/controller/deviceController.ts#L2230-L2324
https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/routes/index.ts#L963
https://github.com/wppconnect-team/wppconnect-server/issues/2701
https://github.com/wppconnect-team/wppconnect-server/pull/2702
https://www.vulncheck.com/advisories/wppconnect-server-through-2.10.74-missing-authentication-via-api-session-chatwoot