CVE-2026-55445 describes an improper authentication vulnerability in whyour's Qinglong platform before version 2.20.1. The init guard middleware only protects the /api/user/init endpoint but not the /open/user/init endpoint. Because the rewrite rule rewrites /open/* paths to /api/* after the JWT authentication and guard middleware have executed, an attacker can bypass authentication by directly accessing /open/user/init. This allows an unauthenticated attacker to reset administrator credentials on an initialized instance, posing a critical security risk. The vulnerability is resolved in version 2.20.1.

An unauthenticated attacker can reset administrator credentials on an initialized Qinglong instance by exploiting the improper authentication of the /open/user/init endpoint. This could lead to full administrative control over the affected system. The CVSS 4.0 score is 9.3 (critical), indicating a high impact with network attack vector, no required privileges, no user interaction, and high confidentiality and integrity impacts.

Upgrade Qinglong to version 2.20.1 or later, where this improper authentication vulnerability is fixed. No other mitigation is indicated or required as the fix addresses the root cause.