walinejs CVE debriefs

CVE-2026-55369

This CVE debrief describes a partial authentication bypass vulnerability in the Waline login endpoint. The endpoint accepts a non-string email as a match-all MongoDB query, allowing an attacker to test a leaked or weak password against the administrator account without knowing the administrator's email. The vulnerability arises from untyped input in the login endpoint, which enables an attacker to bypass [truncated]