CVE-2026-15557

HighCVSS 7.3

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

40th percentile - higher than 40% of all known CVEs

Summary

A weakness has been identified in waooAI waoowaoo up to version 0.4.1, where improper authentication occurs in the functions getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight in src/lib/api-auth.ts. Manipulation of the x-internal-user-id request argument allows remote authentication bypass. The exploit is publicly available and could be used for attacks.

Risk Assessment

The organization is at risk of remote session and project hijacking without proper authentication, potentially leading to unauthorized access to data and system functions.

Recommendation

Immediately update waooAI waoowaoo to a version above 0.4.1 or apply a temporary fix by validating the x-internal-user-id header on the server side.

Other vulnerabilities in waooAI waoowaoo

CVE-2026-15594Low
A vulnerability was found in waooAI waoowaoo up to version 0.4.1 in the stablePublicIdFromStorageKey function of the Media Handler component. Manipulation of the storageKey argument leads to improper authorization, enabling a remote attack with high complexity. The exploit is public and the project has not responded.

Original NVD description (English source)

A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This manipulation of the argument x-internal-user-id request causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.