CVE-2026-91160: OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream
OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenWAto a version that resolves this vulnerability.Fixed in 0.23.5
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments running versions before 0.23.5 are affected if they issue VIEWER API keys and expose the /events WebSocket gateway. Deployments that issue only OPERATOR or ADMIN keys are not affected.
What must an attacker have to exploit this issue?
An attacker needs a VIEWER API key and must subscribe to session.qr through its event name or either wildcard subscription form. An allowed session must also be waiting to be paired so that a QR event is emitted.
Does an allowedSessions restriction limit the exposure?
Yes. A key restricted with allowedSessions can receive pairing QR events only for the sessions permitted by that restriction.
What is the impact of obtaining a pairing QR code?
The key holder can link an external device to the affected WhatsApp account. They can then read and send messages outside OpenWA and its audit trail.
How can this be remediated?
Upgrade OpenWA to version 0.23.5. Until upgrading, avoid issuing VIEWER API keys where possible and restrict existing keys with allowedSessions to limit exposure to specific sessions.