{"items":[{"id":"NVI-00008893","kind":"vulnerability","title":"Waline login accepts a non-string email as a match-all MongoDB query","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jf75-q64q-g65r","CVE-2026-55369"],"plain_summary":"GitHub lists this reviewed advisory for @waline/vercel. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1eb025b5bcd63ed307415497c64aff01"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 1.41.0 for @waline/vercel. Confirm the publisher’s latest guidance.","source_ids":["sr-fa50c170c99e9d643c661694fc33309b"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-28T21:17:59.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1eb025b5bcd63ed307415497c64aff01"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1eb025b5bcd63ed307415497c64aff01","url":"https://github.com/advisories/GHSA-jf75-q64q-g65r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jf75-q64q-g65r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"},{"id":"sr-fa50c170c99e9d643c661694fc33309b","url":"https://github.com/advisories/GHSA-jf75-q64q-g65r","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-jf75-q64q-g65r","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-01T07:24:07.338Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1eb025b5bcd63ed307415497c64aff01"],"technology":"@waline/vercel","known_exclusions":[],"conditions_summary":"## Summary\n\nThe login endpoint POST /api/token reads the `email` field from the request body without checking its type and passes it straight into the MongoDB storage query. When `email` is not a string (for example a JSON object such as {\"$ne\": null}), the MongoDB storage adapter's parseWhere silently DROPS the field rather than rejecting the request, producing an empty filter that matches ALL users. The endpoint then verifies the submitted password against the FIRST user returned (user[0]), which in Waline is the first-registered user — the site administrator.\n\nThis is a PARTIAL authentication bypass, not a full one. The attacker still needs a valid password for that first user; this is not a zero-knowledge bypass and it does not disclose passwords. Its concrete effects are: (1) the email/identifier factor is removed for the administrator account, (2) user enumeration (a non-string email never fails the \"no such user\" branch), and (3) credential-stuffing amplification — an attacker can test a leaked or weak password against the administrator account without knowing the administrator's email.\n\n## Details\n\nUntyped input — packages/server/src/controller/token.js:17-18:\n```\n    const","public_affected_ranges":["<= 1.40.3"]},{"certainty":"source_listed","source_ids":["sr-fa50c170c99e9d643c661694fc33309b"],"technology":"@waline/vercel","known_exclusions":[],"conditions_summary":"## Summary\n\nThe login endpoint POST /api/token reads the `email` field from the request body without checking its type and passes it straight into the MongoDB storage query. When `email` is not a string (for example a JSON object such as {\"$ne\": null}), the MongoDB storage adapter's parseWhere silently DROPS the field rather than rejecting the request, producing an empty filter that matches ALL users. The endpoint then verifies the submitted password against the FIRST user returned (user[0]), which in Waline is the first-registered user — the site administrator.\n\nThis is a PARTIAL authentication bypass, not a full one. The attacker still needs a valid password for that first user; this is not a zero-knowledge bypass and it does not disclose passwords. Its concrete effects are: (1) the email/identifier factor is removed for the administrator account, (2) user enumeration (a non-string email never fails the \"no such user\" branch), and (3) credential-stuffing amplification — an attacker can test a leaked or weak password against the administrator account without knowing the administrator's email.\n\n## Details\n\nUntyped input — packages/server/src/controller/token.js:17-18:\n```\n    const","public_affected_ranges":["SEMVER: introduced 0; fixed 1.41.0"]}],"null_published_at":"2026-11-01T14:34:14.091Z","source_updated_at":"2026-10-28T21:17:59.000Z","source_disclosed_at":"2026-10-28T21:17:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:56:08.420Z"},{"id":"NVI-00008893","kind":"vulnerability","title":"Waline login accepts a non-string email as a match-all MongoDB query","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jf75-q64q-g65r"],"plain_summary":"GitHub lists this reviewed advisory for @waline/vercel. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1eb025b5bcd63ed307415497c64aff01"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-28T21:17:59.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1eb025b5bcd63ed307415497c64aff01"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1eb025b5bcd63ed307415497c64aff01","url":"https://github.com/advisories/GHSA-jf75-q64q-g65r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jf75-q64q-g65r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1eb025b5bcd63ed307415497c64aff01"],"technology":"@waline/vercel","known_exclusions":[],"conditions_summary":"## Summary\n\nThe login endpoint POST /api/token reads the `email` field from the request body without checking its type and passes it straight into the MongoDB storage query. When `email` is not a string (for example a JSON object such as {\"$ne\": null}), the MongoDB storage adapter's parseWhere silently DROPS the field rather than rejecting the request, producing an empty filter that matches ALL users. The endpoint then verifies the submitted password against the FIRST user returned (user[0]), which in Waline is the first-registered user — the site administrator.\n\nThis is a PARTIAL authentication bypass, not a full one. The attacker still needs a valid password for that first user; this is not a zero-knowledge bypass and it does not disclose passwords. Its concrete effects are: (1) the email/identifier factor is removed for the administrator account, (2) user enumeration (a non-string email never fails the \"no such user\" branch), and (3) credential-stuffing amplification — an attacker can test a leaked or weak password against the administrator account without knowing the administrator's email.\n\n## Details\n\nUntyped input — packages/server/src/controller/token.js:17-18:\n```\n    const","public_affected_ranges":["<= 1.40.3"]}],"null_published_at":"2026-10-31T22:13:27.121Z","source_updated_at":"2026-10-28T21:17:59.000Z","source_disclosed_at":"2026-10-28T21:17:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:08.420Z"}],"next_cursor":null,"snapshot_revision":"42594"}