CVE-2026-15594: waooAI waoowaoo Auth Bypass Vulnerability

CVE-2026-15594 Overview

CVE-2026-15594 is an improper authorization vulnerability [CWE-266] in the waooAI waoowaoo project through version 0.4.1. The flaw resides in the stablePublicIdFromStorageKey function within src/lib/media/hash.ts, part of the Media Handler component. Attackers can manipulate the storageKey argument to bypass authorization controls over media resources. The issue is exploitable remotely without authentication or user interaction, though successful exploitation requires high attack complexity. A public exploit exists, and the maintainers were notified through a GitHub issue but have not responded at the time of disclosure.

Critical Impact
Remote attackers can manipulate the storageKey argument to derive stable public identifiers and access media resources without proper authorization checks.

Affected Products

waooAI waoowaoo versions up to and including 0.4.1
Component: Media Handler (src/lib/media/hash.ts)
Function: stablePublicIdFromStorageKey

Discovery Timeline

2026-07-13 - CVE-2026-15594 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15594

Vulnerability Analysis

The vulnerability affects the stablePublicIdFromStorageKey function inside the Media Handler library at src/lib/media/hash.ts. This function derives a stable public identifier from an internal storageKey, and the derived identifier is used to authorize or resolve access to media objects. Because the mapping between storageKey inputs and the resulting public identifier is deterministic and not bound to any per-user authorization context, an attacker able to influence the storageKey argument can produce identifiers that reference media the caller should not be able to reach.

The result is improper authorization [CWE-266], where privilege assignment relies on a value that a remote actor can shape. The confidentiality impact is limited to media resources exposed through this handler, and there is no direct integrity or availability effect. Exploitation requires high complexity, indicating the attacker must satisfy specific timing, encoding, or environmental preconditions before a controlled storageKey yields a usable identifier.

Root Cause

The root cause is a design flaw in how public media identifiers are derived. The function trusts storageKey as an authorization-relevant input without verifying that the caller has rights to the underlying resource. Authorization decisions are effectively delegated to a hash-like transformation instead of an access control check tied to the authenticated principal.

Attack Vector

The attack is remote and network-based. It requires no authentication and no user interaction. An attacker crafts requests that supply chosen storageKey values to reach the vulnerable code path and obtain public identifiers that map to media the attacker is not authorized to view. A public proof-of-concept referenced in the VulDB entry demonstrates the technique. Refer to the waoowaoo GitHub repository and GitHub Issue #201 for technical details of the reported behavior.

Detection Methods for CVE-2026-15594

Indicators of Compromise

Unusual volumes of media fetch requests referencing sequentially or programmatically varied storageKey values.
Requests to media endpoints from unauthenticated sessions that successfully resolve to protected assets.
Access log entries showing the same client enumerating a wide range of public media identifiers in a short window.

Detection Strategies

Instrument the stablePublicIdFromStorageKey code path to log the caller identity, source IP, and requested storageKey for correlation.
Baseline normal media access patterns per user and alert on deviations that suggest identifier enumeration.
Review application logs for repeated 200 responses on media handler routes from IPs that never authenticated.

Monitoring Recommendations

Forward web server and application logs for the Media Handler component to a centralized logging system for retention and analysis.
Add rate limiting and anomaly detection on endpoints backed by the affected function.
Track upstream activity on the waoowaoo GitHub repository for a maintainer response and any patch commits.

How to Mitigate CVE-2026-15594

Immediate Actions Required

Inventory deployments of waooAI waoowaoo and identify any instance at version 0.4.1 or earlier exposing the Media Handler.
Restrict network access to the media endpoints so that only authenticated, authorized clients can reach the vulnerable function.
Enable rate limiting on media routes to raise the cost of identifier enumeration until a fix is available.

Patch Information

No vendor patch is available at the time of publication. The project was informed through GitHub Issue #201 but has not responded. Monitor the waoowaoo GitHub repository and the VulDB entry for CVE-2026-15594 for updates.

Workarounds

Wrap calls to stablePublicIdFromStorageKey with an explicit authorization check that validates the caller has rights to the underlying media object before returning the derived identifier.
Reject or sanitize externally supplied storageKey values at the request boundary so untrusted input never reaches the hashing function.
Place the affected service behind a reverse proxy or web application firewall configured to block anonymous access to media handler routes.

bash

# Example nginx configuration to restrict anonymous access to media handler routes
location /media/ {
    # Require an authenticated session cookie or bearer token
    if ($http_authorization = "") {
        return 401;
    }

    # Basic rate limit to slow identifier enumeration
    limit_req zone=media_zone burst=10 nodelay;

    proxy_pass http://waoowaoo_backend;
}