Vulnerability · Published Aug 3, 2026 · Assigned by GitHub_M
CVE-2026-48063Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
Critical 9.3
In plain English
A critical-severity authentication bypass by spoofing in Baileys from WhiskeySockets. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or "on-demand" sync. This issue has been fixed in versions 6.7.22 and 7.0.0-rc12.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @whiskeysockets/baileys | 6.7.22 | GHSA-qvv5-jq5g-4cgg |
| npm | @whiskeysockets/baileys | 7.0.0-rc12 | GHSA-qvv5-jq5g-4cgg |
| npm | baileys | 6.7.22 | GHSA-qvv5-jq5g-4cgg |
| npm | baileys | 7.0.0-rc12 | GHSA-qvv5-jq5g-4cgg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WhiskeySockets | Baileys | < 6.7.22>= 7.0.0-rc.1, < 7.0.0-rc12 |
| WhiskeySockets | @whiskeysockets/baileys | < 6.7.22>= 7.0.0-rc.1, < 7.0.0-rc12 |
Weakness: CWE-290, CWE-345, CWE-346 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N