Security1 hOctober 29, 2026, 13:30

Waline server flaw allows NoSQL injection and auth bypass

A vulnerability tracked as GHSA-jf75-q64q-g65r with a CVSS score of 6.5 affects the Waline comment server (@waline/vercel) up to version 1.40.3. With MongoDB as storage, POST /api/token fails to validate the email type, letting attackers target the site administrator without knowing their address. It is fixed in 1.41.0.

DEV Community

Open source

Waline server flaw allows NoSQL injection and auth bypass

Affects @waline/vercel 1.40.3 and earlier with MongoDB storage
CVSS 6.5: NoSQL injection and partial authentication bypass
Public PoC exists; patched in version 1.41.0

#Waline#MongoDB

Three Artifactory flaws under active exploitation allow auth bypass and admin access

Security

LiteLLM fixes MCP auth bypass added to CISA exploited list

Security

erxes: 3,394 title hits and a 9.8 auth bypass that outlived its patch

Security

Waline server flaw allows NoSQL injection and auth bypass

Three Artifactory flaws under active exploitation allow auth bypass and admin access

LiteLLM fixes MCP auth bypass added to CISA exploited list

erxes: 3,394 title hits and a 9.8 auth bypass that outlived its patch

Critical Laravel Token Guard auth bypass disclosed