Vulnerability · Published Sep 24, 2026 · Assigned by GitHub_M

CVE-2026-91161OpenWA: VIEWER API keys can read WhatsApp group invite codes

Medium 6.4

In plain English

A medium-severity incorrect authorization in OpenWA from rmyndharis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 92.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group invite code. The invite code is a transferable WhatsApp bearer capability, so an external account can join a group administered by the session without an OpenWA credential, gain read and post access to the group, and retain membership after the VIEWER key is revoked. Affected deployments are those that issue VIEWER keys to parties who should not be able to add accounts to administered groups; OPERATOR and ADMIN access is intended. This issue is fixed in version 0.23.5.

Affected products (as reported)

Vendor	Product	Versions
rmyndharis	OpenWA	< 0.23.5

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-45fh-xj7x-vj2x x_refsource_CONFIRM
https://github.com/rmyndharis/OpenWA/pull/1572 x_refsource_MISC
https://github.com/rmyndharis/OpenWA/commit/a888a0121543426d4e1bf55f9edaed8306ae2699 x_refsource_MISC
https://github.com/rmyndharis/OpenWA/commit/d66439db9653c7aa7cbfb763003c8d3cbc8f623c x_refsource_MISC
https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5 x_refsource_MISC