{"id":"GHSA-v667-gc2r-2xm7","revision":null,"records":[{"revision":"1ed1f47ac0ba43e4a6955df799e7a20e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55445","aliases":[],"title":"Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication","description":"Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.","state":0,"publishedAt":"2026-07-15T21:20:01.43+00:00","modifiedAt":"2026-07-18T02:37:14.779+00:00","affected":[{"ecosystem":"Vendor product","name":"qinglong","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"whyour\",\n                    \"product\": \"qinglong\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.20.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/whyour/qinglong/security/advisories/GHSA-v667-gc2r-2xm7","https://github.com/whyour/qinglong/pull/2941","https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55445","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55445","identifiers":["CVE-2026-55445"]},"retained":false,"historicalAffected":[]},{"revision":"2af2b71d9f8a4582ad7456ca30f53ee2","observedAt":"2026-10-25T13:17:34.255+00:00","statement":{"source":"nvd","id":"CVE-2026-55445","aliases":[],"title":"Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*'…","description":"Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.","state":0,"publishedAt":"2026-07-15T22:17:26.02+00:00","modifiedAt":"2026-10-24T21:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719","https://github.com/whyour/qinglong/pull/2941","https://github.com/whyour/qinglong/security/advisories/GHSA-v667-gc2r-2xm7"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55445","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-287"],"productCriteria":[],"sourceDates":{"published":"2026-07-15T22:17:26.020","lastModified":"2026-10-24T21:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-55445","identifiers":["CVE-2026-55445"]},"retained":false,"historicalAffected":[]},{"revision":"b6cdef9a88ff499a8ba7a85a53c98b50","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-v667-gc2r-2xm7","aliases":["CVE-2026-55445"],"title":"Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication","description":"### Summary\n\nThe init guard middleware in Qinglong only checks `/api/user/init` paths but not `/open/user/init`, which is whitelisted from JWT authentication and rewritten to `/api/user/init` after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances.\n\n### Affected Package\n\n- **Ecosystem:** npm\n- **Package:** whyour/qinglong\n- **Affected versions:** < 6bec52dca158\n- **Patched versions:** >= 6bec52dca158\n\n### Severity\n\nMedium\n\n### CWE\n\nCWE-287 — Improper Authentication\n\n### Details\n\nThe Qinglong panel has an initialization endpoint (`/api/user/init`) that allows setting admin credentials. Once the system is initialized, an init guard middleware is supposed to block further calls. The middleware in `back/loaders/express.ts` only checks:\n\n```javascript\n!['/api/user/init', '/api/user/notification/init'].includes(pathLower)\n```\n\nHowever, the application also has a URL rewrite rule: `rewrite('/open/*', '/api/$1')`. The `/open/*` paths are whitelisted from JWT authentication.\n\nThe middleware ordering creates the bypass: first, JWT auth sees `/open/*` paths match the whitelist regex and skips authentication. Second, the init guard only checks for `/api/user/init` -- `/open/user/init` passes through as \"not an init path\". Third, the URL rewrite transforms `/open/user/init` to `/api/user/init` after the guard has already passed.\n\nThis means an unauthenticated attacker can send `PUT /open/user/init` with new credentials to reset the admin account on any Qinglong panel instance, gaining full administrative access.\n\n### PoC\n\n```javascript\n/**\n * CVE-2026-3965 - Qinglong Panel /open/user/init Auth Bypass\n *\n * The init guard middleware only checks /api/user/init paths.\n * But /open/user/init is whitelisted from JWT auth and rewritten\n * to /api/user/init via express-urlrewrite AFTER the guard.\n */\n\n\"use strict\";\n\n// Simulate the init guard middleware exactly as in the source\nfunction initGuardMiddleware(reqPath, authInfo) {\n  const pathLower = reqPath.toLowerCase();\n  // Exact check from the vulnerable source\n  if (!['/api/user/init', '/api/user/notification/init'].includes(pathLower)) {\n    return { action: \"next\" }; // passes through\n  }\n\n  let isInitialized = true;\n  if (\n    Object.keys(authInfo).length === 2 &&\n    authInfo.username === 'admin' &&\n    authInfo.password === 'admin'\n  ) {\n    isInitialized = false;\n  }\n\n  if (isInitialized) {\n    return { action: \"block\", code: 450, message: \"Error\" };\n  } else {\n    return { action: \"next\" };\n  }\n}\n\nconst authInfo = { username: \"realAdmin\", password: \"str0ngP@ss!\" };\nconsole.log(\"System state: initialized (non-default credentials)\");\n\n// Test 1: Direct /api/user/init is blocked\nconst test1 = initGuardMiddleware(\"/api/user/init\", authInfo);\nconsole.log(\"\\n[Test 1] PUT /api/user/init:\");\nconsole.log(\"  Guard result:\", test1.action);\nconsole.log(\"  Blocked:\", test1.action === \"block\");\n\n// Test 2: /open/user/init BYPASSES init guard\nconst test2 = initGuardMiddleware(\"/open/user/init\", authInfo);\nconsole.log(\"\\n[Test 2] PUT /open/user/init:\");\nconsole.log(\"  Guard result:\", test2.action);\nconsole.log(\"  Bypassed guard:\", test2.action === \"next\");\n\nif (test2.action === \"next\") {\n  const rewrittenPath = \"/open/user/init\".replace(/^\\/open\\//, \"/api/\");\n  console.log(\"  After rewrite:\", rewrittenPath);\n  console.log(\"  Reaches init handler: true\");\n}\n\nif (test1.action === \"block\" && test2.action === \"next\") {\n  console.log(\"\\nVULNERABILITY CONFIRMED: /open/user/init bypasses the init guard\");\n  console.log(\"An attacker can reset admin credentials on an initialized instance.\");\n  process.exit(0);\n} else {\n  console.log(\"\\nVULNERABILITY NOT CONFIRMED\");\n  process.exit(1);\n}\n```\n\n**Steps to reproduce:**\n1. `git clone https://github.com/whyour/qinglong /tmp/qinglong_test`\n2. `cd /tmp/qinglong_test && git checkout 6bec52dc~1`\n3. `node poc.js`\n\n**Expected output:**\n```\nVULNERABILITY CONFIRMED\n/open/user/init bypasses the init guard; the guard only checks /api/user/init but /open/ path is whitelisted and rewritten after.\n```\n\n### Impact\n\nAn unauthenticated attacker can send `PUT /open/user/init` with new credentials to reset the admin account on any Qinglong panel instance. This provides full administrative access, enabling the attacker to execute arbitrary cron jobs and scripts on the server.\n\n### Suggested Remediation\n\nAdd `/open/user/init` and `/open/user/notification/init` to the init guard check list. Alternatively, move the URL rewrite middleware to run before the init guard. Consider implementing the init guard at the handler level rather than as path-based middleware.\n\n### References\n\n- Incomplete fix commit: https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719\n- Original CVE: CVE-2026-3965","state":0,"publishedAt":"2026-08-20T18:36:59+00:00","modifiedAt":"2026-08-20T18:45:14.886926+00:00","affected":[{"ecosystem":"npm","name":"@whyour/qinglong","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.20.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/whyour/qinglong/security/advisories/GHSA-v667-gc2r-2xm7","https://nvd.nist.gov/vuln/detail/CVE-2026-55445","https://github.com/whyour/qinglong/pull/2941","https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719","https://github.com/whyour/qinglong"],"sourceUrl":"https://github.com/advisories/GHSA-v667-gc2r-2xm7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-v667-gc2r-2xm7","identifiers":["GHSA-v667-gc2r-2xm7","CVE-2026-55445"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T06:23:11.1755366+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T06:23:11.1755366+00:00","lastSuccessAt":"2026-10-27T06:23:11.3565583+00:00","error":null,"lastVerifiedAt":"2026-10-27T06:23:11.3565593+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-d89028bfe484b9f2f1584c390248bf5d4aaf0d2d77cee1f0194aa28f589e2a1c","complete":true,"records":414861,"lastAttemptAt":"2026-10-27T06:23:10.0360294+00:00","lastSuccessAt":"2026-10-27T06:23:10.0059652+00:00","error":null,"lastVerifiedAt":"2026-10-27T06:23:10.0360294+00:00","snapshotPublishedAt":"2026-10-27T05:33:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T06:23:43.0819677+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T06:23:11.1755366+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T06:23:11.1755366+00:00","lastSuccessAt":"2026-10-27T06:23:11.3582007+00:00","error":null,"lastVerifiedAt":"2026-10-27T06:23:11.358201+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-aabec971d7d04375928662238d3061aa","complete":false,"records":13416,"lastAttemptAt":"2026-10-27T06:23:41.1678372+00:00","lastSuccessAt":"2026-10-27T06:23:41.164+00:00","error":null,"lastVerifiedAt":"2026-10-27T06:23:41.164+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13077,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T06:23:10.673414+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T06:23:10.673414+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T06:23:10.0870813+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T06:23:10.0870813+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-27T06:23:11.0608384+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-27T06:23:11.0608384+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-2c2579bb03487537529e2b647fd2d9950cfc0fec1a9832dba33e322b8dcbe369","complete":true,"records":230812,"lastAttemptAt":"2026-10-27T06:23:10.5680382+00:00","lastSuccessAt":"2026-10-26T21:37:26.5810298+00:00","error":null,"lastVerifiedAt":"2026-10-27T06:23:10.5680382+00:00","snapshotPublishedAt":"2026-10-26T21:33:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}