CVE-2026-15557

waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication

View on CVE.org
Published Jul 13, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This manipulation of the argument x-internal-user-id request causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

The vulnerability, identified as CWE-287, lies in the getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight functions of the Internal Task Header Handler. By manipulating the x‑internal‑user‑id header, an attacker can bypass the authentication check and obtain access to protected internal task resources. This unauthorized access can expose confidential information or enable privileged operations within the affected project.

Affected Systems

waooAI waoowaoo component versions up to and including 0.4.1 are affected. The flaw is present in the src/lib/api-auth.ts file of the Internal Task Header component.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score of <1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Remote exploitation is possible when an attacker crafts a request that includes a forged x‑internal‑user‑id header, implying a network-borne attack vector.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade waooAI waoowaoo to a version newer than 0.4.1 that incorporates the authentication patch
  • If an immediate upgrade is not feasible, validate the x‑internal‑user‑id header against the authenticated user context and reject any requests where the header does not match the verified identity
  • Configure network‑level controls to limit exposure of the internal API endpoints, restricting access to trusted networks or VPNs only

Generated by OpenCVE AI on July 31, 2026 at 11:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This manipulation of the argument x-internal-user-id request causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication
First Time appeared Waooai
Waooai waoowaoo
Weaknesses CWE-287
CPEs cpe:2.3:a:waooai:waoowaoo:*:*:*:*:*:*:*:*
Vendors & Products Waooai
Waooai waoowaoo
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 13, 2026, 6:11 PM
Reserved
Jul 13, 2026, 5:03 AM

View source JSON

Updated
Jul 13, 2026, 6:07 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 10:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 11:45 AM

JSON