https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:39:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338612 EUVD-2026-338612 https://cve.radiocsirt.org/vuln/euvd-2026-338612 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55445 <p>Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite(&#39;/open/*&#39;, &#39;/api/$1&#39;) rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.</p> <p>Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite(&#39;/open/*&#39;, &#39;/api/$1&#39;) rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55445 https://cve.radiocsirt.org/vuln/ghsa-v667-gc2r-2xm7 <p><strong>Affected:</strong> npm: @whyour/qinglong</p> <p>### Summary</p> <p>The init guard middleware in Qinglong only checks `/api/user/init` paths but not `/open/user/init`, which is whitelisted from JWT authentication and rewritten to `/api/user/init` after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances.</p> <p>### Affected Package</p> <p>- **Ecosystem:** npm - **Package:** whyour/qinglong - **Affected versions:** &lt; 6bec52dca158 - **Patched versions:** &gt;= 6bec52dca158</p> <p>### Severity</p> <p>Medium</p> <p>### CWE</p> <p>CWE-287 — Improper Authentication</p> <p>### Details</p> <p>The Qinglong panel has an initialization endpoint (`/api/user/init`) that allows setting admin credentials. Once the system is initialized, an init guard middleware is supposed to block further calls. The middleware in `back/loaders/express.ts` only checks:</p> <p>```javascript ![&#39;/api/user/init&#39;, &#39;/api/user/notification/init&#39;].includes(pathLower) ```</p> <p>However, the application also has a URL rewrite rule: `rewrite(&#39;/open/*&#39;, &#39;/api/$1&#39;)`. The `/open/*` paths are whitelisted from JWT authentication.</p> <p>The middleware ordering creates the bypass: first, JWT auth sees `/open/*` paths match the whitelist regex and skips authentication. Second, the init guard only checks for `/api/user/init` -- `/open/user/init` passes through as &#34;not an init path&#34;. Third, the URL rewrite transforms `/open/user/init` to `/api/user/init` after the guard has already passed.</p> <p>This means an unauthenticated attacker can send `PUT /open/user/init` with new credentials to reset the adm…</p> <p><strong>Affected:</strong> npm: @whyour/qinglong</p> <p>### Summary</p> <p>The init guard middleware in Qinglong only checks `/api/user/init` paths but not `/open/user/init`, which is whitelisted from JWT authentication and rewritten to `/api/user/init` after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances.</p> <p>### Affected Package</p> <p>- **Ecosystem:** npm - **Package:** whyour/qinglong - **Affected versions:** &lt; 6bec52dca158 - **Patched versions:** &gt;= 6bec52dca158</p> <p>### Severity</p> <p>Medium</p> <p>### CWE</p> <p>CWE-287 — Improper Authentication</p> <p>### Details</p> <p>The Qinglong panel has an initialization endpoint (`/api/user/init`) that allows setting admin credentials. Once the system is initialized, an init guard middleware is supposed to block further calls. The middleware in `back/loaders/express.ts` only checks:</p> <p>```javascript ![&#39;/api/user/init&#39;, &#39;/api/user/notification/init&#39;].includes(pathLower) ```</p> <p>However, the application also has a URL rewrite rule: `rewrite(&#39;/open/*&#39;, &#39;/api/$1&#39;)`. The `/open/*` paths are whitelisted from JWT authentication.</p> <p>The middleware ordering creates the bypass: first, JWT auth sees `/open/*` paths match the whitelist regex and skips authentication. Second, the init guard only checks for `/api/user/init` -- `/open/user/init` passes through as &#34;not an init path&#34;. Third, the URL rewrite transforms `/open/user/init` to `/api/user/init` after the guard has already passed.</p> <p>This means an unauthenticated attacker can send `PUT /open/user/init` with new credentials to reset the adm…</p> https://cve.radiocsirt.org/vuln/ghsa-v667-gc2r-2xm7