CVE-2026-2577
Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge
- State
- Published
- Severity
- 10.0 Critical
- Published
- Feb 16, 2026
- Updated
- Feb 17, 2026
- Reserved
- Feb 16, 2026
Description
The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | tenable |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
nanobotHKUDS |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.