The vulnerability arises from an incomplete authentication check in Qinglong’s init guard middleware. An unauthenticated attacker can issue a PUT request to /open/user/init, which bypasses normal JWT protection and resets the administrator password. This results in privilege escalation and complete compromise of the platform. The weakness is a classic authentication bypass (CWE-287).

Qinglong by whyour, versions prior to 2.20.1 are affected. Upgrading to 2.20.1 or later removes the flaw.

The CVSS score of 9.3 marks this flaw as critical, while an EPSS score of less than 1% suggests low current exploitation likelihood. It is not listed in the CISA KEV catalog. The exploit requires no prior authentication and relies on the open /open/* path being rewritten after JWT authentication, making it straightforward for an attacker to hit the vulnerable endpoint.