CVE-2026-55369

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

CVE-2026-55369

The comment system Waline is vulnerable to a partial authentication bypass in versions prior to 1.41.1 . The POST /api/token login endpoint fails to validate the type of the email field in the request body. When a non-string value (e.g., a JSON object like `{

EUVD-2026-112060

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...