The vulnerability in OpenWA allows an API key with only viewer privileges to receive the session.qr event over the /events WebSocket stream. This event contains the QR code used to pair a WhatsApp session. Because the HTTP endpoint that normally issues QR codes requires an OPERATOR role, the WebSocket exposure bypasses this restriction, enabling an attacker to pair an external device to the account and read or send messages outside of OpenWA’s audit trail. The flaw is a missing authorization check for the QR event, classified as CWE‑862.

Affected deployments run rmyndharis:OpenWA version 0.23.4 or earlier. The problem does not affect installations that exclusively issue OPERATOR or ADMIN keys, nor versions 0.23.5 and later where the patch removes the QR event for keys with restricted role scopes. Any environment hosting the WebSocket /events endpoint with viewer‑only API keys is vulnerable.

With a CVSS score of 8.2, the risk is high. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the lack of an authorization guard on a WebSocket event stream makes exploitation straightforward. An attacker who can subscribe to the session.qr event stream—such as by possessing a VIEWER key—can intercept the QR code, pair a new device, and then access or transmit messages for the associated WhatsApp account, potentially bypassing OpenWA’s monitoring. The attack vector is the WebSocket event stream, requiring no privileged HTTP access beyond the read‑only key.