All vulnerabilities
CVE-2026-91161GHSA-45fh-xj7x-vj2x

OpenWA: VIEWER API keys can read WhatsApp group invite codes

rmyndharis OpenWA
Open in ThreatlineRecord JSON
CVSS
6.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.23.5Fixed versionGitHub
Published24 Sep 2026Updated 5 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group invite code. The invite code is a transferable WhatsApp bearer capability, so an external account can join a group administered by the session without an OpenWA credential, gain read and post access to the group, and retain membership after the VIEWER key is revoked. Affected deployments are those that issue VIEWER keys to parties who should not be able to add accounts to administered groups; OPERATOR and ADMIN access is intended. This issue is fixed in version 0.23.5.

Text from CVE List

Affected versions 2

  • OpenWAaffected: < 0.23.5CVE List
  • OpenWA, other<= 0.23.4GitHub

References 5