Waline login accepts a non-string email as a match-all MongoDB query

影響: npm:@waline/vercel <= 1.40.3 → 1.41.0

The login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as {"$ne": null}), the MongoDB storage adapter's parseWhere silently DROPS the field rather than rejecting the request, producing an empty filter that matches ALL users. The endpoint then verifies the submitted password against the FIRST user returned (user[0]), which in Waline i…

在 GitHub Advisory Database 阅读

2026/10/29 06:17，GitHub Advisory Database 发布了“Waline login accepts a non-string email as a match-all MongoDB query”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js、MongoDB、Vercel。