CVE-2026-123617
Openwhyd before 1.65.1 NoSQL Injection via POST /api/user
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.
| CWE | CWE-943 |
| Vendor | openwhyd |
| Product | openwhyd |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for openwhyd openwhyd
Be the first to know when new medium vulnerabilities affecting openwhyd openwhyd are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
openwhyd / openwhyd
0 < 1.65.1
References
github.com: https://github.com/openwhyd/openwhyd/security/advisories/GHSA-hfg3-vq24-hprp github.com: https://github.com/openwhyd/openwhyd/commit/167c45d6754df0adb3415f71cbd7cde91cbe7874 github.com: https://github.com/openwhyd/openwhyd/releases/tag/v1.65.1 github.com: https://github.com/openwhyd/openwhyd/blob/v1.65.0/app/models/user.js#L288-L294 vulncheck.com: https://www.vulncheck.com/advisories/openwhyd-before-1.65.1-nosql-injection-via-post-api-user
Credits
Tommaso Bona (ParzivalHack) satoridev01 Adrien Joly