{"id":"CVE-2026-121557","title":"WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot","summary":"WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-306"],"vendor":"wppconnect","product":"wppconnect-server","affected":["wppconnect-server <= 2.10.74"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T15:17:14.257Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121557","references":[{"url":"https://github.com/wppconnect-team/wppconnect-server/issues/2701","label":"GitHub Issue #2701"},{"url":"https://github.com/wppconnect-team/wppconnect-server"},{"url":"https://github.com/wppconnect-team/wppconnect-server/pull/2702","label":"Fix commit"},{"url":"https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/routes/index.ts#L963"},{"url":"https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/controller/deviceController.ts#L2230-L2324"},{"url":"https://www.vulncheck.com/advisories/wppconnect-server-through-2.10.74-missing-authentication-via-api-session-chatwoot","label":"VulnCheck Advisory: WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot"}],"tags":["cve.org"],"epss":0.00411,"epssPercentile":0.35563,"ingestedAt":"2026-11-05T19:30:42.978Z","slug":"CVE-2026-121557","body":"## Overview\n\nWPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.\n\n## Affected\n\n- `wppconnect-server <= 2.10.74`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}