---
id: CVE-2026-121557
title: >-
  WPPConnect Server through 2.10.74 Missing Authentication via
  /api/:session/chatwoot
summary: >-
  WPPConnect Server through 2.10.74 contains a missing authentication
  vulnerability that allows unauthenticated attackers to send WhatsApp messages
  by calling the Chatwoot webhook route without verifyToken middleware.
  Attackers who know or…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: wppconnect
product: wppconnect-server
affected:
  - wppconnect-server <= 2.10.74
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T15:17:14.257Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121557'
references:
  - url: 'https://github.com/wppconnect-team/wppconnect-server/issues/2701'
    label: 'GitHub Issue #2701'
  - url: 'https://github.com/wppconnect-team/wppconnect-server'
  - url: 'https://github.com/wppconnect-team/wppconnect-server/pull/2702'
    label: Fix commit
  - url: >-
      https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/routes/index.ts#L963
  - url: >-
      https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/controller/deviceController.ts#L2230-L2324
  - url: >-
      https://www.vulncheck.com/advisories/wppconnect-server-through-2.10.74-missing-authentication-via-api-session-chatwoot
    label: >-
      VulnCheck Advisory: WPPConnect Server through 2.10.74 Missing
      Authentication via /api/:session/chatwoot
tags:
  - cve.org
epss: 0.00411
epssPercentile: 0.35563
ingestedAt: '2026-11-05T19:30:42.978Z'
---

## Overview

WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.

## Affected

- `wppconnect-server <= 2.10.74`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.