waoowaoo
CVE-2026-15594
LOW
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no privileges required, but high complexity; only limited confidentiality impact with no scope change, integrity, or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Media Handler. The manipulation of the argument storageKey results in improper authorization. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Improper authorization in waoowaoo (versions up to 0.4.1) allows remote, unauthenticated attackers to bypass access controls on media resources by manipulating the storageKey argument passed to the stablePublicIdFromStorageKey function in the Media Handler component. The impact is limited to partial confidentiality disclosure (VC:L in CVSS 4.0), with no integrity or availability consequence. No vendor patch has been issued as of analysis time; a public exploit exists via a GitHub issue report (POC), though high attack complexity (AC:H) constrains opportunistic exploitation. This vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The affected component is the Media Handler library located at src/lib/media/hash.ts within the waoowaoo project (CPE: cpe:2.3:a:waooai:waoowaoo:*:*:*:*:*:*:*:*), developed by waooAI. The function stablePublicIdFromStorageKey appears to derive or validate a publicly addressable identifier from an internal storage key, a common pattern in media serving pipelines where storage paths are hashed or transformed for public exposure. CWE-285 (Improper Authorization) indicates that the function fails to enforce adequate access control checks before resolving or exposing the derived identifier - an attacker who can manipulate the storageKey input can cause the function to authorize access to media assets they should not be permitted to retrieve. This is distinct from authentication bypass in the strictest sense: the system may correctly identify the caller but incorrectly authorize the resource lookup based on the crafted key value.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the coordinated disclosure submitted via GitHub issue #201 (https://github.com/waooAI/waoowaoo/issues/201). As a compensating control, operators should consider restricting network access to the Media Handler endpoint - particularly any route that invokes stablePublicIdFromStorageKey - to authenticated or trusted clients only via a reverse proxy or API gateway layer; note that this adds latency and operational overhead. Alternatively, deploying network-layer access controls (IP allowlisting, WAF rules targeting malformed storageKey patterns) can reduce exposure surface. Monitoring the VulDB advisory at https://vuldb.com/vuln/378109 and the GitHub repository for a patch release is recommended. Organizations with strict confidentiality requirements for media assets should consider disabling public media resolution features until a fix is available.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today