Executive brief
waooAI waoowaoo, an AI-driven film and video production platform, contains a security flaw in how it verifies user identities. An attacker can bypass authentication by providing a specific header in their web request, especially if the system is using default settings or is in a testing mode. This allows an unauthorized person to impersonate legitimate users, potentially viewing private project data, modifying assets, or consuming account credits.
Technical details
An authentication bypass exists in waooAI waoowaoo up to 0.4.1 within the `getInternalTaskSession` function in `src/lib/api-auth.ts`. The application improperly trusts the `x-internal-user-id` and `x-internal-task-token` HTTP headers to establish user sessions. If the `INTERNAL_TASK_TOKEN` environment variable is unset (in non-production environments) or left at its public default value (e.g., from `docker-compose.yml`), a remote, unauthenticated attacker can supply a known or empty token to impersonate any user by their UUID. This forged session is subsequently trusted by `requireUserAuth` and other authorization wrappers, granting access to sensitive API routes. As of the advisory date, the project has not responded to the issue report.
Affected products
- waooAI waoowaoo up to 0.4.1
Timeline
- 2026-06-10: disclosed: Issue reported to the project via GitHub issue #200
- 2026-07-13: advisory: CVE-2026-15557 published by VulDB/NVD