EUVD-2026-68774Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker initiates own OIDC flow, captures auth code
-
DeliveryCrafts checksession.php callback URL with attacker's code
-
ExploitPhishes victim into visiting crafted URL
-
ExecutionWallos exchanges attacker's code without validating state
-
PersistVictim's browser session authenticated as attacker account
-
ImpactVictim enters personal/subscription data visible to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim's Wallos instance has OIDC login configured and enabled - this is a non-default, administrator-selected integration with an external identity provider. The victim must actively follow a crafted URL to the Wallos OIDC callback endpoint (checksession.php), meaning social engineering or a redirect chain is required (CVSS UI:A). The attack is limited to Wallos instances with OIDC enabled; instances using only local username/password authentication are not affected. The identity provider itself does not need to be compromised - the attacker only needs to have a valid account at the same IdP connected to the victim's Wallos. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A) scores 7.5, with AT:P reflecting that the victim's Wallos instance must have OIDC configured - a non-default, operator-selected feature. UI:A is required, meaning the victim must actively visit a crafted URL. The VC:H/VI:H/VA:H impact accurately reflects that once the victim is silently logged into the attacker's account, any subscription data, payment information, or personal details the victim enters are harvested by the attacker, and the victim loses effective access to their own data for the session. No EPSS score is available, and the CVE is not listed in CISA KEV, indicating no confirmed widespread exploitation. Given that Wallos is a niche self-hosted tool with a limited user base, real-world risk is constrained by prevalence, but individual instances with OIDC enabled represent a meaningful risk because the attack is low-complexity once a victim is targeted. |
| Exploit ScenarioDerived | An attacker initiates their own OIDC authorization flow against Wallos, capturing the authorization code issued by the identity provider before it is exchanged. They then craft a callback URL pointing to the victim's Wallos instance (checksession.php) containing their authorization code but an arbitrary or omitted state value. When the victim is socially engineered into clicking this link - via phishing email, malicious redirect, or embedded iframe - Wallos exchanges the attacker's code and logs the victim in as the attacker's account, silently exposing any data the victim subsequently enters. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
OIDC login CSRF in Wallos prior to 4.9.4 allows a remote unauthenticated attacker to log a victim into the attacker's own account by tricking them into visiting a crafted callback URL. The root cause is that checksession.php processes the OIDC authorization callback without validating the state parameter against the session-stored nonce generated in login.php, breaking the OIDC CSRF protection mechanism entirely. No public exploit has been identified at time of analysis, but the attack requires only that the victim use OIDC login and click a malicious link, making it low-friction for a motivated attacker.
RemediationAI
Upgrade to Wallos v4.9.5 or later; v4.9.4 introduced the OIDC state validation fix (commit 85bba48) but is marked broken due to a container startup failure - do not deploy 4.9.4. The fix validates the OIDC state parameter in checksession.php against $_SESSION['oidc_state'] before processing the callback. Release notes and binaries are available at https://github.com/ellite/Wallos/releases/tag/v4.9.4 (advisory) and the corrected container at v4.9.5. As a temporary workaround for instances that cannot upgrade immediately, disabling the OIDC login option and relying on local authentication eliminates the vulnerable code path entirely, at the cost of requiring users to manage local credentials.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Wallos is a PHP-based self-hosted subscription tracker (cpe:2.3:a:ellite:wallos:*). It implements OpenID Connect (OIDC) single sign-on, where login.php generates an anti-CSRF state nonce stored in $_SESSION['oidc_state'] as part of the authorization request. The OIDC specification requires that the relying party validate the state parameter returned in the callback URI against this session value before exchanging the authorization code. checksession.php, which handles the OIDC callback, omits this comparison entirely (CWE-352: Cross-Site Request Forgery). The attacker substitutes their own OIDC authorization code in a crafted callback URL; when the victim's browser is directed to that URL, Wallos completes the token exchange and establishes a session authenticated as the attacker's identity provider account, not the victim's.
Know when Wallos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-delivered CSRF with no attacker privileges; user interaction required; confidentiality and integrity high due to account takeover, availability low since victim session is disrupted but service remains up.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account. This issue has been patched in version 4.9.4.
Articles & Coverage 1
Technical POC Analysis
CWE-352 (CSRF), specifically OIDC login CSRF / state-nonce bypass.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Wallos deployments are vulnerable to account hijacking where unauthenticated attackers manipulate OIDC login flows to trick users into compromising their accounts, risking unauthorized access to sensitive data and system functionality. Any organization running Wallos with OIDC-based authentication faces immediate exploitation risk from low-friction social engineering attacks. Urgent mitigation is required to prevent account takeovers and data exposure.
No vendor-released patch identified at time of analysis. Interim mitigations include: temporarily disable OIDC login until patched; implement IP allowlisting or VPN requirements for administrative accounts; monitor authentication logs for impossible travel, suspicious geolocation changes, and off-hours access; require step-up re-authentication for sensitive operations; educate users to avoid clicking external authentication links and verify URLs directly with IT.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to res
Server-side request forgery in Wallos versions before 4.6.2 allows authenticated attackers to conduct arbitrary network
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. R
Wallos versions 4.6.0 and below allow authenticated attackers to perform Server-Side Request Forgery attacks through the
Path traversal in Wallos subscription tracker versions prior to 4.6.2 allows unauthenticated remote attackers to read ar
Reflected cross-site scripting (XSS) in Wallos password reset functionality before version 4.6.2 allows unauthenticated
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excludi
Zip Slip path traversal in Wallos's database restore endpoint allows an authenticated administrator to write arbitrary f
SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct th
Wallos, an open-source self-hostable subscription tracker, contains a Server-Side Request Forgery (SSRF) vulnerability i
Wallos prior to version 4.6.2 contains an authorization bypass allowing authenticated users to delete avatar files belon
Exploit-DB