Wallos CVE-2026-33417

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N indicates network-based attack vector with high attack complexity, requiring no privileges or user interaction, resulting in high confidentiality impact but low integrity and no availability impact. The real-world risk is moderated by the attack complexity requirement (AC:H), which necessitates an attacker to actively intercept a password reset email or have access to email accounts, network traffic, or compromised email servers. No public exploit proof-of-concept or active exploitation in the wild has been reported via the provided intelligence. This vulnerability presents a lower operational priority than the CVSS base score suggests because exploitation requires either initial access (email interception) or social engineering, making it primarily a risk in targeted attacks against high-value accounts rather than widespread automated exploitation. Organizations running Wallos with standard email security controls and HTTPS enforcement have substantially reduced exposure.

An attacker intercepts a Wallos user's password reset email containing a reset token link, either via network sniffing on an unencrypted connection, compromise of an email provider account, or social engineering. The attacker stores this token and waits weeks or months before attempting to use it, long after the user has forgotten about the reset request and may have relaxed security awareness. Because the application never validates token age, the attacker successfully completes the password reset with the stale token, gaining full account access to view and modify the victim's tracked subscriptions, payment history, and personal financial data.