CVE-2026-55445 Details
Description
Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.
An authentication bypass vulnerability has been identified in the Qinglong timed task management platform, prior to version 2.20.1. The issue arises in the init guard middleware, which fails to properly validate the '/open/user/init' path. This oversight allows an unauthenticated attacker to send a PUT request to '/open/user/init' and reset administrator credentials on an initialized instance. The vulnerability exists because the '/open/*' paths are whitelisted from JWT authentication and are rewritten to '/api/user/init' after the guard has already been bypassed.
Users can update to Qinglong version 2.20.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/whyour/qinglong/security/advisories/GHSA-v667-gc2r-2xm7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/whyour/qinglong/commit/6bec52dca158481258315ba0fc2f11206df7b719 | [email protected] | Source CodeVendor |
| https://github.com/whyour/qinglong/pull/2941 | [email protected] | Issue TrackingVendor |
| https://github.com/whyour/qinglong/security/advisories/GHSA-v667-gc2r-2xm7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Qinglong | < 2.20.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |