Waline login accepts a non-string email as a match-all MongoDB query
影響: npm:@waline/vercel <= 1.40.3 → 1.41.0
The login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as {"$ne": null}), the MongoDB storage adapter's parseWhere silently DROPS the field rather than rejecting the request, producing an empty filter that matches ALL users. The endpoint then verifies the submitted password against the FIRST user returned (user[0]), which in Waline i…
X で速報を受け取る悪用・大規模な漏洩・障害を、対処法と一緒に。
フォロー @vulnpulse_app| 情報源 | GitHub Advisory Database |
|---|---|
| 取得日時 | 2026/10/29 09:48 |
| データ | Markdown JSON |
2026/10/29 06:17、GitHub Advisory Databaseが「Waline login accepts a non-string email as a match-all MongoDB query」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js、MongoDB、Vercel。