Threats affecting pkg:npm/waline

Waline versions prior to 1.41.1 have a partial authentication bypass vulnerability in the login endpoint POST /api/token. The endpoint reads the email field from the request body without validating its type and passes it directly into a MongoDB query. If the email is a non-string JSON object, the query filter becomes empty and matches all users, causing the system to verify the password against the first user (the administrator). This allows attackers to bypass the email check for the administrator account, enabling user enumeration and credential-stuffing amplification. The issue is patched in version 1.41.1.