MEDIUM 6.9 NVD
CVE-2026-123197
WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through
WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks.
References
- https://github.com/wppconnect-team/wppconnect-server/blob/d08285afca862e60fb82675ce73e630d
- https://github.com/wppconnect-team/wppconnect-server/commit/bf1faac7a14892207348c3dc5f6e03
- https://github.com/wppconnect-team/wppconnect-server/issues/2708
- https://github.com/wppconnect-team/wppconnect-server/pull/2709
- https://hackmd.io/@hieund/wppconnect-files-unauth-cross-session-sticker-media-disclosure
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-05 via NVD.
vulnfeed aggregates 16740 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.