CVE-2026-55369

Name of the Vulnerable Software and Affected Versions Waline versions prior to 1.41.1

Description The login endpoint 'POST /api/token' reads the email field from the request body without type validation and passes it directly into a MongoDB storage query. If the email field is provided as a non-string type, such as a JSON object, the parseWhere() function in the MongoDB storage adapter drops the field, resulting in an empty filter that matches all users. The system then validates the provided password against the first user returned, which is typically the site administrator. This leads to a partial authentication bypass where the email identifier is removed for the administrator account, enabling user enumeration and credential-stuffing amplification, as an attacker can test passwords against the administrator account without knowing their email.

Recommendations Update to version 1.41.1.