CVE-2026-15557

Name of the Vulnerable Software and Affected Versions waooAI waoowaoo versions prior to 0.4.2

Description Improper authentication occurs in the Internal Task Header Handler component within the src/lib/api-auth.ts library. The issue resides in the getInternalTaskSession(), getAuthSession(), requireUserAuth(), requireProjectAuth(), and requireProjectAuthLight() functions. A remote attacker can exploit this by manipulating the x-internal-user-id request argument.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the x-internal-user-id argument in requests to the affected functions to minimize the risk of exploitation.