CVE-2026-55445

Name of the Vulnerable Software and Affected Versions Qinglong versions prior to 2.20.1

Description An authentication bypass exists in the init guard middleware located in back/loaders/express.ts. The system validates the /api/user/init endpoint but fails to check /open/user/init. Because the rewrite('/open/*','/api/$1') function rewrites whitelisted /open/* paths after JWT authentication and guard checks are bypassed, an unauthenticated attacker can send a PUT request to the /open/user/init endpoint to reset administrator credentials on an initialized instance.

Recommendations Update to version 2.20.1.