This vulnerability affects waooAI waoowaoo up to version 0.4.1 in the src/lib/api-auth.ts library component. The functions getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight improperly handle the x-internal-user-id request argument, leading to improper authentication. Remote exploitation is possible without privileges or user interaction. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). The project has been informed but has not issued a patch or official remediation.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms remotely, potentially gaining unauthorized access to internal tasks or project resources. The impact is limited to the affected versions 0.4.0 and 0.4.1 of waooAI waoowaoo. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected component or implementing additional authentication controls as a temporary measure.