GHSA-JF75-Q64Q-G65R: GHSA-jf75-q64q-g65r: NoSQL Query Manipulation and Partial Authentication Bypass in Waline Server

GHSA-jf75-q64q-g65r: NoSQL Query Manipulation and Partial Authentication Bypass in Waline Server Vulnerability ID: GHSA-JF75-Q64Q-G65R CVSS Score: 6.5 Published: 2026-10-28 An improper input validation and NoSQL query construction vulnerability exists in the Waline comment system server (@waline/vercel) version 1.40.3 and earlier. When MongoDB is used as the backend storage engine, the POST /api/token authentication endpoint fails to validate that the user-supplied email parameter is a string. Supplying a JSON object or array operator causes the MongoDB storage adapter to omit the email filter or construct an unintended match-all query, returning all user records and allowing unauthenticated attackers to target the site administrator account directly without knowing the administrator's email address. TL;DR Waline versions <= 1.40.3 fail to validate the data type of the email parameter during authentication at POST /api/token. When backed by MongoDB, passing a non-string value (such as a JSON object) causes the query builder to drop the email constraint and execute an empty filter query. Because the login controller selects the first returned record—which corresponds to the primary site administrator—an attacker can perform targeted password guessing or credential stuffing against the administrator account without knowing its email address. ⚠️ Exploit Status: POC Technical Details Vulnerability ID: GHSA-jf75-q64q-g65r Weakness Class: CWE-287 (Improper Authentication) / CWE-943 (NoSQL Injection) Attack Vector: Network (HTTP POST to /api/token) CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Affected Component: @waline/vercel <= 1.40.3 (with MongoDB storage) Patched Version: @waline/vercel 1.41.0 Impact: Partial authentication bypass (factor elimination) and targeted admin credential stuffing Exploit Status: Proof-of-Concept (PoC) Publicly Documented Affected Systems @waline/vercel walinejs/waline (packages/server) @waline/vercel: <= 1.40.3 (Fixed in: 1.41.0) Code Analysis Commit: e611aed Enforce required email and string password validation rules in TokenLogic.postAction() and add integration tests for POST /api/token. File: packages/server/src/logic/token.js @@ -35,6 +35,17 @@ module.exports = class TokenLogic extends Base { * @apiSuccess (200) {String} errmsg return error message if error */ async postAction() { + this.rules = { + email: { + required: true, + email: true, + }, + password: { + required: true, + string: true, + }, + }; + await this.useCaptchaCheck(); } Enter fullscreen mode Exit fullscreen mode Exploit Details GitHub Security Advisory: Official advisory containing proof-of-concept explanation demonstrating non-string email parameter handling in MongoDB deployments. Mitigation Strategies Upgrade @waline/vercel to version 1.41.0 or newer to enforce strict string and email format validation in TokenLogic. Harden the MongoDB storage adapter (parseWhere) to explicitly reject or throw errors when non-string and non-array query values are encountered. Implement Web Application Firewall (WAF) rules to block HTTP POST requests to /api/token containing JSON objects or arrays in the email field. Enable Waline CAPTCHA verification and rate limiting on authentication endpoints to prevent automated credential stuffing. Remediation Steps: Update package.json in your Waline deployment repository to specify "@waline/vercel": "^1.41.0". Run npm install @waline/vercel@^1.41.0 or pnpm update @waline/vercel to fetch the patched release. Redeploy the Waline server instance on Vercel or your self-hosted Node.js environment. Verify the fix by sending a test POST request to /api/token with {"email": {"$ne": null}, "password": "test"} and confirming that the server responds with errno: 1001. References GitHub Advisory Record: GHSA-jf75-q64q-g65r Waline Repository Security Advisory: GHSA-jf75-q64q-g65r Fix Pull Request #3646 Fix Commit e611aed4e571c2a86103f5cee48791ca6b460360 Reporter Credit Profile (dizconnectz) Read the full report for GHSA-JF75-Q64Q-G65R on our website for more details including interactive diagrams and full exploit analysis.