CVE-2025-55177 Meta Platforms WhatsApp Incorrect Authorization

Exploited in the wild Medium 5.4 Published 29 Aug 2025 Updated 7 Oct 2026

Incomplete authorization in WhatsApp iOS allowed attackers to trigger URL processing, potentially enabling code execution when combined with an OS vulnerability.

Exploited in the wild: Since 2 Sep 2025
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-55177?

CVE-2025-55177 is a medium-severity missing authorization vulnerability in Facebook WhatsApp Business for iOS, published on 29 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

Weakness: CWE-863

Which versions are affected by CVE-2025-55177?

It affects 2 products.

Products include Whatsapp Whatsapp, Whatsapp Whatsapp Business.

How do I fix CVE-2025-55177?

No fix has been published for CVE-2025-55177 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Sep 2025.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-55177 being exploited?

Yes. Attackers have exploited CVE-2025-55177 in the wild since at least 2 Sep 2025.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-f7wf-m2qg-r9rx.