Description

WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-05T19:17:18.187Z",
  "pubdate": "2026-11-05T19:17:18.187Z",
  "executiveSummary": "WPPConnect Server versions up to 2.10.76 are susceptible to a missing authentication vulnerability within the static file handling mechanism. This flaw enables unauthenticated remote attackers to bypass established per-session security controls and access sensitive decrypted sticker media. By exploiting the predictable naming convention of files exposed via the /files static mount, an attacker can enumerate and exfiltrate private user data without valid session tokens. The vulnerability poses a significant risk to user privacy, as it permits unauthorized access to communication artifacts that should be protected by authentication. There are no specialized requirements for exploitation other than network access to the server, making this a high-impact security oversight in the application's access control implementation.",
  "technicalDetails": "The vulnerability resides in the implementation of the /files static mount within the WPPConnect Server. The application fails to enforce authentication or session-based validation when processing requests for resources served from this directory. Consequently, the server treats requests to the /files/file<timestamp>.webp path as publicly accessible, disregarding whether the requesting client possesses a valid authorization token associated with the specific session that generated the sticker.\nThe root cause is an insecure access control configuration where the server's static file handler lacks integration with the application's middleware authentication layer. Because the file naming convention relies on Unix timestamps, the naming space is computationally predictable and brute-forceable. An attacker can systematically enumerate potential timestamps to identify valid file references stored in the server's cache or storage directory.\nThe attack flow proceeds as follows: First, the attacker identifies the base URL for the target WPPConnect Server. Second, the attacker initiates a series of HTTP GET requests to the /files endpoint, systematically iterating through Unix timestamps. Third, if the requested file exists, the server returns the decrypted sticker media associated with that timestamp, effectively bypassing the intended per-session restriction. Because the server does not validate the requester's identity or cross-reference the session ID against the resource owner, the system treats the malicious request as legitimate.\nThis vulnerability is present in all versions through 2.10.76. The exposure is critical because it bypasses the primary security mechanism designed to isolate session data. Post-exploitation, an attacker can monitor, archive, and exfiltrate sticker media from any active or historical session stored on the server. The impact includes the unauthorized disclosure of private communications and potential exposure of sensitive or personally identifiable information contained within shared media stickers."
}