The vulnerability CVE-2026-15557 affects waooAI waoowaoo versions 0.4.0 and 0.4.1. It is caused by improper authentication due to manipulation of the x-internal-user-id request argument in functions getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight within src/lib/api-auth.ts. This allows remote attackers to bypass authentication controls in the Internal Task Header Handler component. The vulnerability is publicly disclosed with exploit code available, but the vendor has not issued a fix or official response. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability allows remote attackers to bypass authentication mechanisms in waooAI waoowaoo, potentially granting unauthorized access to internal tasks or project resources. This could lead to unauthorized actions or data exposure within the affected component. However, there is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Users of waooAI waoowaoo versions 0.4.0 and 0.4.1 should monitor vendor communications for updates. Until a fix is released, consider implementing additional access controls or network-level restrictions to limit exposure of the affected component. Avoid relying solely on the vulnerable authentication functions for critical security enforcement.