Partial Authentication Bypass in Waline Comment System

CVE-2026-55369

What is CVE-2026-55369?

The Waline comment system, prior to version 1.41.1, contains a vulnerability within its login endpoint that allows for a partial authentication bypass. When processing the email field from incoming requests, the system fails to enforce strict type validation. Consequently, if an attacker specifies a non-string email, the system generates an empty filter for the MongoDB query, effectively bypassing the intended user authentication checks. This results in the first user registered—a site administrator—being targeted directly, enabling challenges like user enumeration and credential stuffing. Although this bypass does require knowledge of the administrator's password, it crucially eliminates the email check, exposing the system to potential attacks. Version 1.41.1 addresses this issue, ensuring better validation and security.

References