rmyndharis vulnerabilities

Products

• OpenWA 2

Latest rmyndharis CVEs

Newest publication first

1. CVE-2026-91161 OpenWA: VIEWER API keys can read WhatsApp group invite codes

   Published 2026-09-24

   Medium·CVSS 6.4 EPSS 0.18%

   OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retr...

2. CVE-2026-91160 OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream

   Published 2026-09-24

   High·CVSS 8.2 EPSS 0.25%

   OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.