Waline Login Accepts A Non-string Email As A Match-all MongoDB Query

Summary The login endpoint POST /api/token reads the "email" field from the request body without checking its type and passes it straight into the MongoDB storage query. When "email" is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently...

Waline login accepts a non-string email as a match-all MongoDB query

Summary The login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently DROPS...

CVE-2026-55369

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

EUVD-2026-112060

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

CVE-2026-55369

The comment system Waline is vulnerable to a partial authentication bypass in versions prior to 1.41.1 . The POST /api/token login endpoint fails to validate the type of the email field in the request body. When a non-string value (e.g., a JSON object like `{

CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

PT-2026-128224

Name of the Vulnerable Software and Affected Versions Waline versions prior to 1.41.1 Description The login endpoint 'POST /api/token' reads the email field from the request body without type validation and passes it directly into a MongoDB storage query. If the email field is provided as a...

EUVD-2022-29473

Malicious code in bioql PyPI...

CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

Malware in waline-magic

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in waline-magic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a36651e1c228b2c1cc270f4d650d20db1da7126756f6ae78b407b803174a517 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-958 Malicious code in waline-magic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a36651e1c228b2c1cc270f4d650d20db1da7126756f6ae78b407b803174a517 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

Code injection

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

CVE-2022-24594

CVE-2022-24594 affects waline 1.6.1. An attacker can submit messages with a forged IP address by manipulating the X-Forwarded-For header, enabling IP spoofing. Multiple connected sources (Red Hat advisory, Veracode note) indicate this can bypass IP-related checks such as IP frequency limits, affe...

CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...