WhaTicket Community Authentication Bypass Allows Admin Self-Registration

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability.

Unauthenticated attackers can self-register as administrators via POST /auth/signup by omitting the profile field or setting it to admin.

Successful exploitation grants:

• User management
• Settings access
• Access to all tickets, contacts, messages, and WhatsApp connections