CVE-2026-91160Published
OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-91160 · Microsoft / collected KEV context
cve-program · CVE-2026-91160
- https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-m427-j4h4-9qwj
- https://github.com/rmyndharis/OpenWA/pull/1602
- https://github.com/rmyndharis/OpenWA/commit/acc23c3803c07f43791a92e8e48456572fd69bdc
- https://github.com/rmyndharis/OpenWA/commit/b9d9ea1c57bde98b7833a5d6e482998703667ef0
- https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.