EUVD-2026-43334Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable auth bypass requiring no privileges or interaction; low C/I/A as impact is bounded to session impersonation, not full system compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This manipulation of the argument x-internal-user-id request causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Authentication bypass in waooAI waoowaoo through version 0.4.1 allows unauthenticated remote attackers to spoof internal user identity by manipulating the x-internal-user-id HTTP request header, defeating the authentication controls implemented across multiple auth functions in the API layer. Affected are the getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight functions in src/lib/api-auth.ts, meaning both user-level and project-level authorization gates can be circumvented. A publicly available exploit (POC) exists via GitHub issue #200; the vendor has not yet responded to the disclosure, and no patch has been released.
Technical ContextAI
The vulnerability resides in src/lib/api-auth.ts within the waooAI waoowaoo application (CPE: cpe:2.3:a:waooai:waoowaoo:*:*:*:*:*:*:*:*), specifically in the Internal Task Header Handler component. CWE-287 (Improper Authentication) identifies the root cause: the application trusts the x-internal-user-id HTTP request header value supplied by the client without adequate server-side validation or cryptographic verification. Because multiple authentication and authorization functions - getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight - all share this flawed trust model, the bypass is pervasive across the authentication stack rather than isolated to a single code path. This is a header-injection class of improper authentication where the server delegates identity assertion to the client.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor has not responded to the responsible disclosure submitted via GitHub issue #200 (https://github.com/waooAI/waoowaoo/issues/200). As a compensating control, operators should immediately restrict network access to the waoowaoo service to trusted internal networks or VPN-only endpoints, preventing untrusted clients from sending arbitrary HTTP headers to the Internal Task Handler. Additionally, deploying a WAF or reverse proxy rule to reject or strip any incoming x-internal-user-id headers before they reach the application will block the specific attack vector. Note that WAF-based header stripping is a compensating control, not a fix - the underlying trust logic in api-auth.ts remains vulnerable to any client that bypasses the proxy. Monitoring application logs for unexpected or high-frequency x-internal-user-id values can serve as a detection signal. Organizations should track the upstream GitHub repository (https://github.com/waooAI/waoowaoo) for a patched release and upgrade immediately when one becomes available.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today