The Waline login endpoint in @waline/vercel before version 1.41.0 accepts a non-string email value, which leads to a MongoDB query filter that matches all users. This causes the login process to verify the submitted password against the first-registered user (the administrator) without requiring the correct email. This vulnerability enables partial authentication bypass, user enumeration, and credential-stuffing amplification against the administrator account.