Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.

Source published

15 Jul 2026 21:20:01 UTC

Source modified

18 Jul 2026 02:37:14 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.

Source published

15 Jul 2026 22:17:26 UTC

Source modified

24 Oct 2026 21:10:00 UTC

Observed here

25 Oct 2026 13:17:34 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

### Summary The init guard middleware in Qinglong only checks `/api/user/init` paths but not `/open/user/init`, which is whitelisted from JWT authentication and rewritten to `/api/user/init` after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances. ### Affected Package - **Ecosystem:** npm - **Package:** whyour/qinglong - **Affected versions:** < 6bec52dca158 - **Patched versions:** >= 6bec52dca158 ### Severity Medium ### CWE CWE-287 — Improper Authentication ### Details The Qinglong panel has an initialization endpoint (`/api/user/init`) that allows setting admin credentials. Once the system is initialized, an init guard middleware is supposed to block further calls. The middleware in `back/loaders/express.ts` only checks: ```javascript !['/api/user/init', '/api/user/notification/init'].includes(pathLower) ``` However, the application also has a URL rewrite rule: `rewrite('/open/*', '/api/$1')`. The `/open/*` paths are whitelisted from JWT authentication. The middleware ordering creates the bypass: first, JWT auth sees `/open/*` paths match the whitelist regex and skips authentication. Second, the init guard only checks for `/api/user/init` -- `/open/user/init` passes through as "not an init path". Third, the URL rewrite transforms `/open/user/init` to `/api/user/init` after the guard has already passed. This means an unauthenticated attacker can send `PUT /open/user/init` with new credentials to reset the admin account on any Qinglong panel instance, gaining full administrative access. ### PoC ```javascript /** * CVE-2026-3965 - Qinglong Panel /open/user/init Auth Bypass * * The init guard middleware only checks /api/user/init paths. * But /open/user/init is whitelisted from JWT auth and rewritten * to /api/user/init via express-urlrewrite AFTER the guard. */ "use strict"; // Simulate the init guard middleware exactly as in the source function initGuardMiddleware(reqPath, authInfo) { const pathLower = reqPath.toLowerCase(); // Exact check from the vulnerable source if (!['/api/user/init', '/api/user/notification/init'].includes(pathLower)) { return { action: "next" }; // passes through } let isInitialized = true; if ( Object.keys(authInfo).length === 2 && authInfo.username === 'admin' && authInfo.password === 'admin' ) { isInitialized = false; } if (isInitialized) { return { action: "block", code: 450, message: "Error" }; } else { return { action: "next" }; } } const authInfo = { username: "realAdmin", password: "str0ngP@ss!" }; console.log("System state: initialized (non-default credentials)"); // Test 1: Direct /api/user/init is blocked const test1 = initGuardMiddleware("/api/user/init", authInfo); console.log("\n[Test 1] PUT /api/user/init:"); console.log(" Guard result:", test1.action); console.log(" Blocked:", test1.action === "block"); // Test 2: /open/user/init BYPASSES init guard const test2 = initGuardMiddleware("/open/user/init", authInfo); console.log("\n[Test 2] PUT /open/user/init:"); console.log(" Guard result:", test2.action); console.log(" Bypassed guard:", test2.action === "next"); if (test2.action === "next") { const rewrittenPath = "/open/user/init".replace(/^\/open\//, "/api/"); console.log(" After rewrite:", rewrittenPath); console.log(" Reaches init handler: true"); } if (test1.action === "block" && test2.action === "next") { console.log("\nVULNERABILITY CONFIRMED: /open/user/init bypasses the init guard"); console.log("An attacker can reset admin credentials on an initialized instance."); process.exit(0); } else { console.log("\nVULNERABILITY NOT CONFIRMED"); process.exit(1); } ``` **Steps to reproduce:** 1. `git clone https://github.com/whyour/qinglong /tmp/qinglong_test` 2. `cd /tmp/qinglong_test && git checkout 6bec52dc~1` 3. `node poc.js` **Expected output:** ``` VULNERABILITY CONFIRMED /open/user/init bypasses the init guard; the guard only checks /api/user/init but /open/ path is whitelisted and rewritten after. ``` ### Impact An unauthenticated attacker can send `PUT /open/user/init` with new credentials to reset the admin account on any Qinglong panel instance. This provides full administrative access, enabling the attacker to execute arbitrary cron jobs and scripts on the server. ### Suggested Remediation Add `/open/user/init` and `/open/user/notification/init` to the init guard check list. Alternatively, move the URL rewrite middleware to run before the init guard. Consider implementing the init guard at the handler level rather than as path-based middleware. ### References - Incomplete fix commit: https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719 - Original CVE: CVE-2026-3965

Source published

20 Aug 2026 18:36:59 UTC

Source modified

20 Aug 2026 18:45:14 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Publisher rating · CRITICAL