Auth bypass in Wppconnect Wppconnect-Server
CVE-2026-121557
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/wppconnect-team/wppconnect-server/issues/2701 (issue-tracking)
- github.com/wppconnect-team/wppconnect-server (product)
- github.com/wppconnect-team/wppconnect-server/pull/2702 (issue-tracking, patch)
- github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/routes/index.ts (technical-description)
- github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/controller/devic… (technical-description)
- www.vulncheck.com/advisories/wppconnect-server-through-2.10.74-missing-authenti… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-121557?
- CVE-2026-121557 is a medium-severity vulnerability in Wppconnect Wppconnect-Server, classified under Missing Authentication for Critical Function. CVSS score: 5.9/10. Published 2026-11-03.
- How severe is CVE-2026-121557?
- Medium severity. CVSS v3 base score is 5.9 out of 10.