EUVD-2026-14967Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_resets table includes a created_at timestamp column, but the token validation logic never checks it. A password reset token remains valid indefinitely until it is used, allowing an attacker who intercepts a reset link at any point to use it days, weeks, or months later. This issue has been patched in version 4.7.2.
AnalysisAI
Wallos, an open-source self-hostable subscription tracker, contains an authentication bypass vulnerability in its password reset mechanism where reset tokens never expire. Versions prior to 4.7.2 are affected, allowing attackers who intercept a password reset link to use it indefinitely days, weeks, or months after generation. An attacker exploiting this vulnerability can gain unauthorized account access and potentially modify subscription data, though the CVSS score of 6.5 reflects moderate real-world risk due to the required interception precondition.
Technical ContextAI
The vulnerability exists in Wallos's password reset token validation logic, specifically in the password_resets database table which contains a created_at timestamp column that is never consulted during token validation. This represents a classic CWE-613 vulnerability (Insufficient Session Expiration), where the application fails to implement time-based token expiration despite having the necessary infrastructure. The affected product is identified by CPE cpe:2.3:a:ellite:wallos:*:*:*:*:*:*:*:*, indicating all versions of the Ellite Wallos product prior to remediation. The root cause is inadequate access control implementation wherein the token validation function checks token existence and validity but omits temporal constraints, leaving reset tokens as persistent credentials rather than ephemeral ones.
RemediationAI
Upgrade Wallos to version 4.7.2 or later immediately to apply the patch that implements token expiration validation. The patched version adds temporal checking of the created_at timestamp during password reset token validation, preventing use of stale tokens. Until upgrade is feasible, administrators should implement compensating controls including enforcing strict password reset token lifetime at the reverse proxy or firewall level (e.g., 15-30 minute maximum validity windows), ensuring all password reset communications occur over HSTS-enforced HTTPS connections, monitoring password_resets table for tokens with excessive age, and educating users to complete password resets immediately upon receipt rather than deferring the process. Refer to the official GitHub security advisory at https://github.com/ellite/Wallos/security/advisories/GHSA-p3fv-m43r-3fhf for patching instructions.
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to res
Server-side request forgery in Wallos versions before 4.6.2 allows authenticated attackers to conduct arbitrary network
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. R
Wallos versions 4.6.0 and below allow authenticated attackers to perform Server-Side Request Forgery attacks through the
Path traversal in Wallos subscription tracker versions prior to 4.6.2 allows unauthenticated remote attackers to read ar
Reflected cross-site scripting (XSS) in Wallos password reset functionality before version 4.6.2 allows unauthenticated
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excludi
Wallos prior to version 4.6.2 contains an authorization bypass allowing authenticated users to delete avatar files belon
Wallos versions prior to 4.6.2 contain a server-side request forgery (SSRF) vulnerability in the webhook notification te
DNS rebinding bypass in Wallos subscription tracker allows authenticated users to exfiltrate internal network data via S
Wallos versions 4.8.4 and prior allow authenticated users to bypass webhook URL restrictions and send server-side reques
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today