---
id: "CVE-2026-55369"
kind: "vulnerability"
aliases: ["CVE-2026-55369"]
title: "Waline: login with non-string email reaches the admin account"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["comment-system", "mongodb", "package", "self-hosted", "waline"]
not_affected_if: ["login-endpoint-not-exposed", "non-mongodb-storage", "patched-1.41.1"]
published_at: "2026-10-28T13:17:08+00:00"
first_seen_at: "2026-10-28T13:33:01+00:00"
updated_at: "2026-10-28T13:34:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55369", "first_seen_at": "2026-10-28T13:33:01+00:00"}]
---

# Waline: login with non-string email reaches the admin account

Waline's login endpoint POST /api/token passes an unchecked email field into a MongoDB query, so an object like {"$ne": null}, which the storage layer silently drops, matches every user. The endpoint then checks the submitted password against the first registered user, the site administrator. An attacker still needs that user's password, but can skip the email and test leaked or weak passwords against the admin account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `@waline/vercel` or `@waline/server` version (or the Waline package in use) and see if it is below `1.41.1`.
- Confirm the deployment uses a MongoDB storage adapter, since the bypass depends on the MongoDB parseWhere behaviour.
- Send a login request to POST /api/token with a JSON object in the email field and check whether it fails or returns a token for the admin account.

## Fix

- Upgrade Waline to `1.41.1` or later.
- Until upgraded, restrict access to the /api/token login endpoint or rate limit it to slow credential stuffing.
- Rotate the administrator password if it may have been guessed or reused.

## Timeline

- 2026-10-28T13:33:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55369

## From the sources

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as {"$ne": null}), the MongoDB storage adapter's parseWhere silently DROPS the field rather than rejecting the request, producing an empty filter that matches ALL users. The endpoint then verifies the submitted password against the FIRST user returned (user[0]), which in Waline is the first-registered user — the site administrator. This is a PARTIAL authentication bypass, not a full one. The attacker still needs a valid password for that first user; this is not a zero-knowledge bypass and it does not disclose passwords. Its concrete effects are: (1) the email/identifier factor is removed for the administrator account, (2) user enumeration (a non-string email never fails the "no such user" branch), and (3) credential-stuffing amplification — an attacker can test a leaked or weak password against the administrator account without knowing the administrator's email. This issue has been patched in version 1.41.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_