by Kastro
Paper/Archive/CVE-2026-2577

CVE-2026-2577

HKUDS nanobot — Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge

EPSS 0.7%CVSS 10.0
critical.is priorityof 100
40
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 51.7.517 × 2010.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentication for incoming connections. An unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server to hijack the WhatsApp session. This allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.

Affected

ProductAffectedFixed inSource
nanobot< 0.1.3.Post70.1.3.Post7CNA

Scores by source

tenable (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftenable.com/security/research/tra-2026-09refgithub.com/HKUDS/nanobot/releases/tag/v0.1.3.post7