GHSA-JF75-Q64Q-G65R: GHSA-jf75-q64q-g65r: NoSQL Query Manipulation and Partial Authentication Bypass in Waline Server

#security #cve #cybersecurity #ghsa

GHSA-jf75-q64q-g65r: NoSQL Query Manipulation and Partial Authentication Bypass in Waline Server

Vulnerability ID: GHSA-JF75-Q64Q-G65R
CVSS Score: 6.5
Published: 2026-10-28

An improper input validation and NoSQL query construction vulnerability exists in the Waline comment system server (@waline/vercel) version 1.40.3 and earlier. When MongoDB is used as the backend storage engine, the POST /api/token authentication endpoint fails to validate that the user-supplied email parameter is a string. Supplying a JSON object or array operator causes the MongoDB storage adapter to omit the email filter or construct an unintended match-all query, returning all user records and allowing unauthenticated attackers to target the site administrator account directly without knowing the administrator's email address.

TL;DR

Waline versions <= 1.40.3 fail to validate the data type of the email parameter during authentication at POST /api/token. When backed by MongoDB, passing a non-string value (such as a JSON object) causes the query builder to drop the email constraint and execute an empty filter query. Because the login controller selects the first returned record—which corresponds to the primary site administrator—an attacker can perform targeted password guessing or credential stuffing against the administrator account without knowing its email address.

⚠️ Exploit Status: POC

Technical Details

Vulnerability ID: GHSA-jf75-q64q-g65r
Weakness Class: CWE-287 (Improper Authentication) / CWE-943 (NoSQL Injection)
Attack Vector: Network (HTTP POST to /api/token)
CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Affected Component: @waline/vercel <= 1.40.3 (with MongoDB storage)
Patched Version: @waline/vercel 1.41.0
Impact: Partial authentication bypass (factor elimination) and targeted admin credential stuffing
Exploit Status: Proof-of-Concept (PoC) Publicly Documented

Affected Systems

@waline/vercel
walinejs/waline (packages/server)
@waline/vercel: <= 1.40.3 (Fixed in: 1.41.0)

Code Analysis

Commit: e611aed

Enforce required email and string password validation rules in TokenLogic.postAction() and add integration tests for POST /api/token.

File: packages/server/src/logic/token.js
@@ -35,6 +35,17 @@ module.exports = class TokenLogic extends Base {
    * @apiSuccess (200) {String}  errmsg  return error message if error
    */
   async postAction() {
+    this.rules = {
+      email: {
+        required: true,
+        email: true,
+      },
+      password: {
+        required: true,
+        string: true,
+      },
+    };
+
     await this.useCaptchaCheck();
   }

Exploit Details

GitHub Security Advisory: Official advisory containing proof-of-concept explanation demonstrating non-string email parameter handling in MongoDB deployments.

Mitigation Strategies

Upgrade @waline/vercel to version 1.41.0 or newer to enforce strict string and email format validation in TokenLogic.
Harden the MongoDB storage adapter (parseWhere) to explicitly reject or throw errors when non-string and non-array query values are encountered.
Implement Web Application Firewall (WAF) rules to block HTTP POST requests to /api/token containing JSON objects or arrays in the email field.
Enable Waline CAPTCHA verification and rate limiting on authentication endpoints to prevent automated credential stuffing.

Remediation Steps:

Update package.json in your Waline deployment repository to specify "@waline/vercel": "^1.41.0".
Run npm install @waline/vercel@^1.41.0 or pnpm update @waline/vercel to fetch the patched release.
Redeploy the Waline server instance on Vercel or your self-hosted Node.js environment.
Verify the fix by sending a test POST request to /api/token with {"email": {"$ne": null}, "password": "test"} and confirming that the server responds with errno: 1001.

References

Read the full report for GHSA-JF75-Q64Q-G65R on our website for more details including interactive diagrams and full exploit analysis.

DEV Community