CVE-2026-48063: Baileys WhatsApp API Auth Bypass Flaw

CVE-2026-48063 Overview

CVE-2026-48063 is a critical authentication bypass vulnerability in Baileys, a socket-based TypeScript/JavaScript API for WhatsApp Web. Attackers can send malicious payloads via placeholderResendMessage to trigger fake messages.upsert events with forged message keys and payloads. This enables message spoofing, corruption of the application state sync system through fake key shares, and history sync spoofing that injects fabricated conversation context. The flaw is classified under [CWE-290] Authentication Bypass by Spoofing. It affects Baileys versions prior to 6.7.22 and 7.0.0-rc12.

Critical Impact
Unauthenticated remote attackers can spoof arbitrary WhatsApp messages, corrupt local application state, and inject fake history sync data into any Baileys session.

Affected Products

Baileys versions prior to 6.7.22
Baileys 7.0.0 release candidates prior to 7.0.0-rc12
Applications and bots built on the WhiskeySockets/Baileys library

Discovery Timeline

2026-08-03 - CVE-2026-48063 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-48063

Vulnerability Analysis

The vulnerability resides in the message processing pipeline of Baileys. The library dispatches protocolMessage types without verifying that the sender is the user's own device. WhatsApp's protocol treats several protocolMessage subtypes as self-only, meaning they should exclusively originate from the user's paired device. Baileys accepted these messages from any sender, allowing remote parties to inject state-modifying events.

An attacker exploiting this flaw can invoke placeholderResendMessage to trigger a fake messages.upsert event. The event carries an attacker-controlled message key and payload. Downstream consumers of the Baileys event stream treat the spoofed message as legitimate. The same primitive extends to APP_STATE_SYNC_KEY_SHARE and HISTORY_SYNC_NOTIFICATION messages, enabling corruption of the app state sync system and injection of fabricated conversation history.

Root Cause

Baileys did not enforce the fromMe guard on protocolMessage types that must originate only from the user's own device. The reference implementation in whatsmeow restricts self-only protocol message types via a handleProtocolMessage guard. Baileys lacked this check in src/Utils/process-message.ts, treating attacker-supplied protocol messages as trusted.

Attack Vector

The attack requires no authentication, no user interaction, and no prior privileges. Any remote party able to send a WhatsApp message to a Baileys-driven session can deliver the malicious payload over the network. The impact covers message spoofing, application state corruption via fake key shares, on-demand history sync spoofing, and injection of fake previous conversation context.

typescript

// Security patch in src/Utils/process-message.ts
const protocolMsg = content?.protocolMessage
if (protocolMsg) {
    // Mirror whatsmeow's `handleProtocolMessage` guard, but applied only to
    // the protocol message types that originate from our own device — an
    // attacker could otherwise spoof any of these to manipulate local state.
    //
    // Self-only types (drop if `!fromMe`):
    //   - HISTORY_SYNC_NOTIFICATION
    //   - APP_STATE_SYNC_KEY_SHARE
    //   - LID_MIGRATION_MAPPING_SYNC
    //   - PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE
    //
    // Cross-user types (must NOT be dropped):
    //   - REVOKE, MESSAGE_EDIT, EPHEMERAL_SETTING, GROUP_MEMBER_LABEL_CHANGE
    const SELF_ONLY_TYPES = new Set<proto.Message.ProtocolMessage.Type>([
        proto.Message.ProtocolMessage.Type.HISTORY_SYNC_NOTIFICATION,
        proto.Message.ProtocolMessage.Type.APP_STATE_SYNC_KEY_SHARE,
        proto.Message.ProtocolMessage.Type.LID_MIGRATION_MAPPING_SYNC,
        proto.Message.ProtocolMessage.Type.PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE
    ])
    // ...guard logic drops self-only types when !fromMe
}

Source: GitHub Commit 3beb08e

Detection Methods for CVE-2026-48063

Indicators of Compromise

Inbound protocolMessage payloads containing HISTORY_SYNC_NOTIFICATION, APP_STATE_SYNC_KEY_SHARE, LID_MIGRATION_MAPPING_SYNC, or PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE where the fromMe flag is false.
Unexpected messages.upsert events triggered by placeholderResendMessage calls originating from non-paired JIDs.
Application state sync key rotations or history sync events occurring without a corresponding action on the user's primary device.

Detection Strategies

Audit Baileys dependency versions across all deployments and flag any version below 6.7.22 or 7.0.0-rc12.
Log all protocolMessage types received by the session and correlate the sender JID against the paired device identifier.
Compare message stream timestamps and sender identities against known-good baselines to surface injected historical messages.

Monitoring Recommendations

Enable verbose logging on the Baileys event dispatcher and forward logs to a centralized SIEM for correlation.
Alert on any deviation between messages.upsert event keys and the expected WhatsApp server-signed message identifiers.
Track the frequency of placeholderResendMessage invocations per session to identify abuse patterns.

How to Mitigate CVE-2026-48063

Immediate Actions Required

Upgrade Baileys to version 6.7.22 or 7.0.0-rc12 across all production and development environments.
Rotate any WhatsApp session credentials and application state keys that may have been corrupted before patching.
Review persisted chat history for entries that cannot be corroborated with the user's primary device.

Patch Information

The fix was committed to the WhiskeySockets/Baileys repository in commit 3beb08e. The patch introduces a SELF_ONLY_TYPES set and drops matching protocolMessage payloads when fromMe is false. See the GitHub Security Advisory GHSA-qvv5-jq5g-4cgg for full advisory details and the upstream commit for the reference implementation.

Workarounds

If patching is not immediately possible, wrap the Baileys messages.upsert handler to reject inbound protocolMessage types classified as self-only when the sender is not the paired device.
Restrict Baileys sessions to trusted contact lists and disable unsolicited message processing where the application design permits.
Disable or gate placeholderResendMessage handling until the upgrade is complete.

bash

# Upgrade to a patched Baileys release
npm install @whiskeysockets/baileys@^6.7.22
# or, for the release candidate track:
npm install @whiskeysockets/baileys@7.0.0-rc12

# Verify installed version
npm ls @whiskeysockets/baileys