Product:
WhatsApp bridge
Summary
The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user and intercept all incoming messages and media in real-time.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 10 | CVE-2026-2577 |
Exploitation
To exploit this vulnerability, an attacker must have network access to the Nanobot’s WebSocket server. By connecting to the server on port 3001, the attacker can bypass authentication and gain control over the WhatsApp session. This enables the attacker to send messages, intercept incoming communications, and capture sensitive authentication information.
Affected Products
- WhatsApp bridge: Vulnerable due to binding to all network interfaces without authentication.
Mitigation
To mitigate this vulnerability, it is recommended to configure the WebSocket server to bind only to specific network interfaces and implement authentication mechanisms for incoming connections. Regular updates and monitoring of the system can also help in reducing the risk of exploitation.