Vulnerability-Lookup

GHSA-V667-GC2R-2XM7

Vulnerability from github – Published: 2026-08-20 18:36 – Updated: 2026-08-20 18:36

Summary

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

Details

Summary

The init guard middleware in Qinglong only checks /api/user/init paths but not /open/user/init, which is whitelisted from JWT authentication and rewritten to /api/user/init after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances.

Affected Package

Ecosystem: npm
Package: whyour/qinglong
Affected versions: < 6bec52dca158
Patched versions: >= 6bec52dca158

Severity

Medium

CWE

CWE-287 — Improper Authentication

Details

The Qinglong panel has an initialization endpoint (/api/user/init) that allows setting admin credentials. Once the system is initialized, an init guard middleware is supposed to block further calls. The middleware in back/loaders/express.ts only checks:

!['/api/user/init', '/api/user/notification/init'].includes(pathLower)

However, the application also has a URL rewrite rule: rewrite('/open/*', '/api/$1'). The /open/* paths are whitelisted from JWT authentication.

The middleware ordering creates the bypass: first, JWT auth sees /open/* paths match the whitelist regex and skips authentication. Second, the init guard only checks for /api/user/init -- /open/user/init passes through as "not an init path". Third, the URL rewrite transforms /open/user/init to /api/user/init after the guard has already passed.

This means an unauthenticated attacker can send PUT /open/user/init with new credentials to reset the admin account on any Qinglong panel instance, gaining full administrative access.

PoC

/**
 * CVE-2026-3965 - Qinglong Panel /open/user/init Auth Bypass
 *
 * The init guard middleware only checks /api/user/init paths.
 * But /open/user/init is whitelisted from JWT auth and rewritten
 * to /api/user/init via express-urlrewrite AFTER the guard.
 */

"use strict";

// Simulate the init guard middleware exactly as in the source
function initGuardMiddleware(reqPath, authInfo) {
  const pathLower = reqPath.toLowerCase();
  // Exact check from the vulnerable source
  if (!['/api/user/init', '/api/user/notification/init'].includes(pathLower)) {
    return { action: "next" }; // passes through
  }

  let isInitialized = true;
  if (
    Object.keys(authInfo).length === 2 &&
    authInfo.username === 'admin' &&
    authInfo.password === 'admin'
  ) {
    isInitialized = false;
  }

  if (isInitialized) {
    return { action: "block", code: 450, message: "Error" };
  } else {
    return { action: "next" };
  }
}

const authInfo = { username: "realAdmin", password: "str0ngP@ss!" };
console.log("System state: initialized (non-default credentials)");

// Test 1: Direct /api/user/init is blocked
const test1 = initGuardMiddleware("/api/user/init", authInfo);
console.log("\n[Test 1] PUT /api/user/init:");
console.log("  Guard result:", test1.action);
console.log("  Blocked:", test1.action === "block");

// Test 2: /open/user/init BYPASSES init guard
const test2 = initGuardMiddleware("/open/user/init", authInfo);
console.log("\n[Test 2] PUT /open/user/init:");
console.log("  Guard result:", test2.action);
console.log("  Bypassed guard:", test2.action === "next");

if (test2.action === "next") {
  const rewrittenPath = "/open/user/init".replace(/^\/open\//, "/api/");
  console.log("  After rewrite:", rewrittenPath);
  console.log("  Reaches init handler: true");
}

if (test1.action === "block" && test2.action === "next") {
  console.log("\nVULNERABILITY CONFIRMED: /open/user/init bypasses the init guard");
  console.log("An attacker can reset admin credentials on an initialized instance.");
  process.exit(0);
} else {
  console.log("\nVULNERABILITY NOT CONFIRMED");
  process.exit(1);
}

Steps to reproduce: 1. git clone https://github.com/whyour/qinglong /tmp/qinglong_test 2. cd /tmp/qinglong_test && git checkout 6bec52dc~1 3. node poc.js

Expected output:

VULNERABILITY CONFIRMED
/open/user/init bypasses the init guard; the guard only checks /api/user/init but /open/ path is whitelisted and rewritten after.

Impact

An unauthenticated attacker can send PUT /open/user/init with new credentials to reset the admin account on any Qinglong panel instance. This provides full administrative access, enabling the attacker to execute arbitrary cron jobs and scripts on the server.

Suggested Remediation

Add /open/user/init and /open/user/notification/init to the init guard check list. Alternatively, move the URL rewrite middleware to run before the init guard. Consider implementing the init guard at the handler level rather than as path-based middleware.

References

Incomplete fix commit: https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719
Original CVE: CVE-2026-3965

Severity

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@whyour/qinglong"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.20.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55445"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:36:59Z",
    "nvd_published_at": "2026-07-15T22:17:26Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nThe init guard middleware in Qinglong only checks `/api/user/init` paths but not `/open/user/init`, which is whitelisted from JWT authentication and rewritten to `/api/user/init` after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances.\n\n### Affected Package\n\n- **Ecosystem:** npm\n- **Package:** whyour/qinglong\n- **Affected versions:** \u003c 6bec52dca158\n- **Patched versions:** \u003e= 6bec52dca158\n\n### Severity\n\nMedium\n\n### CWE\n\nCWE-287 \u2014 Improper Authentication\n\n### Details\n\nThe Qinglong panel has an initialization endpoint (`/api/user/init`) that allows setting admin credentials. Once the system is initialized, an init guard middleware is supposed to block further calls. The middleware in `back/loaders/express.ts` only checks:\n\n```javascript\n![\u0027/api/user/init\u0027, \u0027/api/user/notification/init\u0027].includes(pathLower)\n```\n\nHowever, the application also has a URL rewrite rule: `rewrite(\u0027/open/*\u0027, \u0027/api/$1\u0027)`. The `/open/*` paths are whitelisted from JWT authentication.\n\nThe middleware ordering creates the bypass: first, JWT auth sees `/open/*` paths match the whitelist regex and skips authentication. Second, the init guard only checks for `/api/user/init` -- `/open/user/init` passes through as \"not an init path\". Third, the URL rewrite transforms `/open/user/init` to `/api/user/init` after the guard has already passed.\n\nThis means an unauthenticated attacker can send `PUT /open/user/init` with new credentials to reset the admin account on any Qinglong panel instance, gaining full administrative access.\n\n### PoC\n\n```javascript\n/**\n * CVE-2026-3965 - Qinglong Panel /open/user/init Auth Bypass\n *\n * The init guard middleware only checks /api/user/init paths.\n * But /open/user/init is whitelisted from JWT auth and rewritten\n * to /api/user/init via express-urlrewrite AFTER the guard.\n */\n\n\"use strict\";\n\n// Simulate the init guard middleware exactly as in the source\nfunction initGuardMiddleware(reqPath, authInfo) {\n  const pathLower = reqPath.toLowerCase();\n  // Exact check from the vulnerable source\n  if (![\u0027/api/user/init\u0027, \u0027/api/user/notification/init\u0027].includes(pathLower)) {\n    return { action: \"next\" }; // passes through\n  }\n\n  let isInitialized = true;\n  if (\n    Object.keys(authInfo).length === 2 \u0026\u0026\n    authInfo.username === \u0027admin\u0027 \u0026\u0026\n    authInfo.password === \u0027admin\u0027\n  ) {\n    isInitialized = false;\n  }\n\n  if (isInitialized) {\n    return { action: \"block\", code: 450, message: \"Error\" };\n  } else {\n    return { action: \"next\" };\n  }\n}\n\nconst authInfo = { username: \"realAdmin\", password: \"str0ngP@ss!\" };\nconsole.log(\"System state: initialized (non-default credentials)\");\n\n// Test 1: Direct /api/user/init is blocked\nconst test1 = initGuardMiddleware(\"/api/user/init\", authInfo);\nconsole.log(\"\\n[Test 1] PUT /api/user/init:\");\nconsole.log(\"  Guard result:\", test1.action);\nconsole.log(\"  Blocked:\", test1.action === \"block\");\n\n// Test 2: /open/user/init BYPASSES init guard\nconst test2 = initGuardMiddleware(\"/open/user/init\", authInfo);\nconsole.log(\"\\n[Test 2] PUT /open/user/init:\");\nconsole.log(\"  Guard result:\", test2.action);\nconsole.log(\"  Bypassed guard:\", test2.action === \"next\");\n\nif (test2.action === \"next\") {\n  const rewrittenPath = \"/open/user/init\".replace(/^\\/open\\//, \"/api/\");\n  console.log(\"  After rewrite:\", rewrittenPath);\n  console.log(\"  Reaches init handler: true\");\n}\n\nif (test1.action === \"block\" \u0026\u0026 test2.action === \"next\") {\n  console.log(\"\\nVULNERABILITY CONFIRMED: /open/user/init bypasses the init guard\");\n  console.log(\"An attacker can reset admin credentials on an initialized instance.\");\n  process.exit(0);\n} else {\n  console.log(\"\\nVULNERABILITY NOT CONFIRMED\");\n  process.exit(1);\n}\n```\n\n**Steps to reproduce:**\n1. `git clone https://github.com/whyour/qinglong /tmp/qinglong_test`\n2. `cd /tmp/qinglong_test \u0026\u0026 git checkout 6bec52dc~1`\n3. `node poc.js`\n\n**Expected output:**\n```\nVULNERABILITY CONFIRMED\n/open/user/init bypasses the init guard; the guard only checks /api/user/init but /open/ path is whitelisted and rewritten after.\n```\n\n### Impact\n\nAn unauthenticated attacker can send `PUT /open/user/init` with new credentials to reset the admin account on any Qinglong panel instance. This provides full administrative access, enabling the attacker to execute arbitrary cron jobs and scripts on the server.\n\n### Suggested Remediation\n\nAdd `/open/user/init` and `/open/user/notification/init` to the init guard check list. Alternatively, move the URL rewrite middleware to run before the init guard. Consider implementing the init guard at the handler level rather than as path-based middleware.\n\n### References\n\n- Incomplete fix commit: https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719\n- Original CVE: CVE-2026-3965",
  "id": "GHSA-v667-gc2r-2xm7",
  "modified": "2026-08-20T18:36:59Z",
  "published": "2026-08-20T18:36:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/whyour/qinglong/security/advisories/GHSA-v667-gc2r-2xm7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55445"
    },
    {
      "type": "WEB",
      "url": "https://github.com/whyour/qinglong/pull/2941"
    },
    {
      "type": "WEB",
      "url": "https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/whyour/qinglong"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication"
}

CVE-2026-55445 (GCVE-0-2026-55445)

Vulnerability from cvelistv5 – Published: 2026-07-15 21:20 – Updated: 2026-07-18 02:37

Title

Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication

Summary

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-18 02:36 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/whyour/qinglong/security/advis…	x_refsource_CONFIRM
https://github.com/whyour/qinglong/pull/2941	x_refsource_MISC
https://github.com/whyour/qinglong/commit/6bec52d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
whyour	qinglong	Affected: < 2.20.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55445",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-18T02:36:51.706147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-18T02:37:14.779Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/whyour/qinglong/security/advisories/GHSA-v667-gc2r-2xm7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "qinglong",
          "vendor": "whyour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.20.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite(\u0027/open/*\u0027, \u0027/api/$1\u0027) rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T21:20:01.430Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/whyour/qinglong/security/advisories/GHSA-v667-gc2r-2xm7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/whyour/qinglong/security/advisories/GHSA-v667-gc2r-2xm7"
        },
        {
          "name": "https://github.com/whyour/qinglong/pull/2941",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/whyour/qinglong/pull/2941"
        },
        {
          "name": "https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719"
        }
      ],
      "source": {
        "advisory": "GHSA-v667-gc2r-2xm7",
        "discovery": "UNKNOWN"
      },
      "title": "Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55445",
    "datePublished": "2026-07-15T21:20:01.430Z",
    "dateReserved": "2026-06-16T21:59:57.018Z",
    "dateUpdated": "2026-07-18T02:37:14.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-V667-GC2R-2XM7

Summary

Affected Package

Severity

CWE

Details

PoC

Impact

Suggested Remediation

References

CVE-2026-55445 (GCVE-0-2026-55445)

Tags

Sightings

Nomenclature