Read the docs
TI-2020-01835 Aliases CVE-2020-1908GHSA-gqf3-x727-h474

Improper authorization in Meta WhatsApp Business for iOS

Priority LOW 21CWE-285Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285 and CWE-552.

Summary

Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.

Why it matters now

EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed WhatsApp Business for iOS (Facebook): 2.20.100WhatsApp for iOS (Facebook): 2.20.100

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MetaWhatsApp Business for iOS2.20.100; before 2.20.1002.20.100Patch availableCNA
MetaWhatsApp for iOS2.20.100; before 2.20.1002.20.100Patch availableCNA
  • WhatsApp Business for iOS VendorMeta Affected 2.20.100; before 2.20.100 Fixed in 2.20.100 Patch available CNA
  • WhatsApp for iOS VendorMeta Affected 2.20.100; before 2.20.100 Fixed in 2.20.100 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*before 2.20.100VulnerableWhatsApp
cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:*before 2.20.100VulnerableWhatsApp
  • cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:* Versions before 2.20.100 Vulnerable ·WhatsApp
  • cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:* Versions before 2.20.100 Vulnerable ·WhatsApp

Remediation

  • Fix · CNA WhatsApp Business for iOS (Facebook) Fixed in 2.20.100
  • Fix · CNA WhatsApp for iOS (Facebook) Fixed in 2.20.100

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1908
  2. 2026-10-03 Alias added: GHSA-gqf3-x727-h474

References

Advisory 1

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-13416 Cross-site scripting in Meta WhatsApp Desktop KEVCVSS 3.1HIGH 8.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences