CVE-2026-15557: waooAI Auth Bypass Vulnerability

CVE-2026-15557 Overview

CVE-2026-15557 is an authentication bypass vulnerability in waooAI waoowaoo up to version 0.4.1. The flaw resides in the getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight functions within src/lib/api-auth.ts. Attackers can manipulate the x-internal-user-id request header to bypass authentication controls in the Internal Task Header Handler component. The issue is remotely exploitable over the network without authentication or user interaction. Public exploit details are available, and the project maintainers have not responded to the disclosure. This vulnerability is tracked under [CWE-287] Improper Authentication.

Critical Impact
Unauthenticated remote attackers can bypass authentication by manipulating the x-internal-user-id header, compromising confidentiality, integrity, and availability of protected API resources.

Affected Products

waooAI waoowaoo versions up to and including 0.4.1
Component: Internal Task Header Handler in src/lib/api-auth.ts
Affected functions: getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, requireProjectAuthLight

Discovery Timeline

2026-07-13 - CVE-2026-15557 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15557

Vulnerability Analysis

The vulnerability is an improper authentication weakness [CWE-287] in the API authentication module of waoowaoo. The affected functions in src/lib/api-auth.ts handle session validation and access control for user and project resources. These functions trust the x-internal-user-id HTTP header supplied by the caller without verifying it originates from a trusted internal source. An attacker sending crafted requests with an arbitrary x-internal-user-id value can impersonate other users and access protected endpoints. Because exploitation requires only a network path and no privileges or interaction, the flaw is straightforward to weaponize.

Root Cause

The root cause is misplaced trust in a client-controllable HTTP header. Headers prefixed with x-internal-* are typically expected to be injected by internal infrastructure such as an API gateway or service mesh. The waoowaoo authentication helpers accept the header value directly as an authenticated identity without validating request origin, gateway signature, or transport boundary. This design conflates internal service-to-service authentication with external client requests.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to any endpoint protected by requireUserAuth, requireProjectAuth, requireProjectAuthLight, getAuthSession, or getInternalTaskSession. By including a chosen x-internal-user-id value in the request headers, the attacker is treated as the corresponding user. This grants access to read or modify data associated with that user or their projects.

No verified exploit code has been published in a code repository. See the GitHub Issue #200 and VulDB CVE-2026-15557 entries for technical details.

Detection Methods for CVE-2026-15557

Indicators of Compromise

HTTP requests containing the x-internal-user-id header arriving from external network sources or untrusted client IPs.
Access log entries showing successful authenticated actions without a corresponding session cookie or bearer token.
Repeated requests iterating through numeric or UUID values in the x-internal-user-id header, indicating enumeration.
API activity attributed to user identities that do not match the source IP or geolocation of prior legitimate sessions.

Detection Strategies

Inspect reverse-proxy and web server logs for the x-internal-user-id header on ingress traffic and alert when present on externally-originating requests.
Correlate authentication events with session establishment events; flag actions where an authenticated identity has no preceding login event.
Deploy signatures in web application firewalls that block or log any x-internal-* headers from untrusted origins.

Monitoring Recommendations

Enable verbose request-header logging on the application layer and forward logs to a centralized SIEM for correlation.
Track anomalous per-user API request volume and geographic distribution to identify impersonation.
Monitor the upstream project's GitHub repository for a patched release addressing this issue.

How to Mitigate CVE-2026-15557

Immediate Actions Required

Strip or reject the x-internal-user-id header at the network edge before requests reach the application.
Restrict exposure of waoowaoo endpoints to trusted networks only until a fix is released.
Audit application logs for prior exploitation attempts referencing the x-internal-user-id header.
Rotate any user session tokens, API keys, or project credentials that may have been accessed during the exposure window.

Patch Information

No vendor patch is available at the time of publication. The project was notified through GitHub Issue #200 but has not responded. Track the GitHub Project Repository for future updates and apply the fix once released.

Workarounds

Configure the reverse proxy or API gateway to unconditionally remove x-internal-user-id from all inbound external requests.
Modify local deployments of src/lib/api-auth.ts to require a cryptographically verifiable token in addition to the header, or ignore the header entirely on public endpoints.
Segment internal task-processing traffic onto a private network interface distinct from the public API listener.

bash

# Example: NGINX configuration to strip the untrusted header at the edge
location / {
    proxy_set_header x-internal-user-id "";
    proxy_pass http://waoowaoo_upstream;
}