Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.

Affected: npm: @whyour/qinglong

### Summary

The init guard middleware in Qinglong only checks `/api/user/init` paths but not `/open/user/init`, which is whitelisted from JWT authentication and rewritten to `/api/user/init` after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances.

### Affected Package

- **Ecosystem:** npm - **Package:** whyour/qinglong - **Affected versions:** < 6bec52dca158 - **Patched versions:** >= 6bec52dca158

### Severity

Medium

### CWE

CWE-287 — Improper Authentication

### Details

The Qinglong panel has an initialization endpoint (`/api/user/init`) that allows setting admin credentials. Once the system is initialized, an init guard middleware is supposed to block further calls. The middleware in `back/loaders/express.ts` only checks:

```javascript !['/api/user/init', '/api/user/notification/init'].includes(pathLower) ```

However, the application also has a URL rewrite rule: `rewrite('/open/*', '/api/$1')`. The `/open/*` paths are whitelisted from JWT authentication.

The middleware ordering creates the bypass: first, JWT auth sees `/open/*` paths match the whitelist regex and skips authentication. Second, the init guard only checks for `/api/user/init` -- `/open/user/init` passes through as "not an init path". Third, the URL rewrite transforms `/open/user/init` to `/api/user/init` after the guard has already passed.

This means an unauthenticated attacker can send `PUT /open/user/init` with new credentials to reset the adm…