CVE-2026-121557: WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot

Published Nov 3, 2026

Updated

WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.

Event History

Nov 3, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Event

via NVD·04:17 PM

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs network access to the affected WPPConnect Server endpoint and must know or successfully guess the name of a connected session. No authentication or user interaction is required.

Which deployments are exposed?

Deployments running WPPConnect Server through version 2.10.74 are exposed when a connected session can be targeted through the Chatwoot webhook route. The affected route is /api/:session/chatwoot.

What can an attacker do with a compromised route?

An attacker can submit outgoing message bodies to send arbitrary WhatsApp text messages or files from the connected account to any number.

CVE-2026-121557: WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are exposed?

What can an attacker do with a compromised route?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are exposed?

What can an attacker do with a compromised route?