CVE-2026-48063 Details
Description
Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or "on-demand" sync. This issue has been fixed in versions 6.7.22 and 7.0.0-rc12.
A vulnerability in Baileys, a TypeScript/JavaScript API for WhatsApp Web, allows for message spoofing and corruption of the app state synchronization system. This issue affects Baileys versions prior to 6.7.22 and 7.0.0-rc12. The vulnerability arises from the improper handling of protocol messages, which can be exploited by sending a malicious payload through the placeholderResendMessage. This triggers a fake messages.upsert event, injecting a counterfeit message key and payload, thereby spoofing messages. Additionally, the exploit can corrupt the app state sync by sending fake key shares, and spoof history sync, injecting false previous context or 'on-demand' sync.
Users can update to Baileys version 7.0.0-rc12 or 6.7.22 to address this vulnerability. For those still on Baileys v6, version 6.7.22 is available. As a temporary measure, 'messages.upsert' events containing a 'requestId' field can be dropped, and automatic history sync can be turned off in the socket configuration. However, there is no workaround for the app state sync disruption.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WhiskeySockets/Baileys/commit/3beb08eecfcb4e65722e674034bd84fb11a9de35 | [email protected] | Source CodeVendor |
| https://github.com/WhiskeySockets/Baileys/security/advisories/GHSA-qvv5-jq5g-4cgg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Baileys | < 6.7.22 (semver) < 7.0.0-rc12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |