EUVD-2026-68810Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or abuse Wallos admin credentials
-
DeliveryNavigate to OIDC provider configuration settings
-
ExploitSet token_url or user_info_url to cloud metadata endpoint or internal service URL
-
ExecutionTrigger OIDC login flow as any user
-
PersistServer issues unfiltered curl request to attacker-supplied URL
-
ImpactHarvest returned IAM credentials or internal service data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires Wallos admin-level authentication (confirmed by CVSS PR:H) and the ability to write to OIDC provider configuration settings, specifically the token_url and user_info_url fields. The OIDC authentication feature must be enabled and configured in the target Wallos instance - instances with OIDC disabled are not exploitable via this vector. Maximum impact additionally requires the Wallos server to be deployed in a cloud environment with a reachable link-local metadata service (169.254.169.254 on AWS, GCP, or Azure) or with network-level access to sensitive internal services. Standard non-admin Wallos users cannot access OIDC configuration and cannot trigger this code path. |
| Impact | The CVSS 4.0 score of 8.5 with PR:H accurately reflects that exploitation is gated behind Wallos admin credentials, confining the realistic threat to malicious insiders, compromised admin accounts, or attackers who have already achieved admin-level access through another vulnerability. In cloud-hosted deployments, the impact ceiling is severe: redirecting OIDC URLs to the 169.254.169.254 link-local metadata endpoint can yield cloud IAM credentials, enabling full cloud account takeover cascading well beyond the Wallos application itself. On-premises deployments face internal network pivoting risk. No EPSS data or CISA KEV listing is present in the input, and no public exploit code has been identified, indicating this is not currently under automated mass exploitation. The high CVSS score reflects worst-case cloud-hosted impact; the PR:H requirement means that instances with tightly controlled admin access and OIDC disabled face substantially lower realized risk. |
| Exploit ScenarioDerived | An attacker with Wallos admin access navigates to the OIDC provider configuration panel and sets token_url to http://169.254.169.254/latest/meta-data/iam/security-credentials/ then waits for any user to initiate an OIDC login. The Wallos server issues an unfiltered curl request to the metadata endpoint and the returned IAM credentials surface in OIDC error responses or server logs accessible to the admin. No public exploit code has been identified at time of analysis, but the attack path requires only standard administrative UI interaction and is mechanically straightforward given admin access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct the server to issue arbitrary outbound HTTP requests, including to cloud provider metadata services and internal network hosts. All Wallos releases prior to 4.9.6 are affected; the OIDC callback handler at includes/oidc/handle_oidc_callback.php:18-49 passes admin-supplied token_url and user_info_url directly to curl_init() without the validate_webhook_url_for_ssrf() protection already applied to logo and webhook URL fields. No public exploit has been identified at time of analysis, and a confirmed vendor patch is available in v4.9.6 released 2026-06-22.
RemediationAI
Upgrade Wallos to version 4.9.6, released 2026-06-22, which extends the existing validate_webhook_url_for_ssrf() protection to OIDC token_url and user_info_url parameters. The patched release is available at https://github.com/ellite/Wallos/releases/tag/v4.9.6 and the fix is contained in commit b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3. For operators unable to upgrade immediately, the most effective compensating control is to disable OIDC authentication entirely if it is not actively in use, eliminating this attack surface with the trade-off of forcing users to authenticate via local credentials. Alternatively, apply host-level egress firewall rules that block outbound HTTP from the Wallos server to link-local ranges (169.254.0.0/16) and RFC-1918 internal subnets; this mitigates the highest-impact cloud metadata and internal pivoting scenarios but requires ongoing maintenance and will break OIDC flows if misconfigured or if legitimate provider IPs fall within blocked ranges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Wallos is a PHP self-hosted subscription tracker (CPE: cpe:2.3:a:ellite:wallos:*:*:*:*:*:*:*:*) that supports OIDC-based authentication. Its callback handler in includes/oidc/handle_oidc_callback.php (lines 18-49) uses PHP's curl_init() to fetch token and user-info responses from admin-configured endpoint URLs. CWE-918 (Server-Side Request Forgery) describes the root cause: the application makes server-initiated HTTP requests to URLs it does not validate against an allowlist or block-list for internal addresses. Critically, Wallos already implements a validate_webhook_url_for_ssrf() function used for logo and webhook URL inputs, but this protection was never applied to OIDC endpoint fields, creating an inconsistent trust boundary that persisted until v4.9.6.
Know when Wallos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Admin credential required to set OIDC URLs (PR:H); SSRF escapes Wallos to reach external systems (S:C); read-only credential exposure with no direct write impact (C:H, I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.
Articles & Coverage 1
Technical POC Analysis
CWE-918 (Server-Side Request Forgery).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Wallos subscription tracker versions before 4.9.6 contain a vulnerability in OIDC configuration that allows admin-level users to direct the application to request arbitrary cloud and internal network resources. No public exploit has been identified, but a compromised or malicious administrator could exploit this to steal cloud provider credentials or access internal infrastructure. Organizations must upgrade to v4.9.6 immediately.
Apply vendor patch (v4.9.6, released 2026-06-22). If patching is delayed, disable OIDC if not actively required and restrict administrative access to the Wallos configuration interface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to res
Server-side request forgery in Wallos versions before 4.6.2 allows authenticated attackers to conduct arbitrary network
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. R
Wallos versions 4.6.0 and below allow authenticated attackers to perform Server-Side Request Forgery attacks through the
Path traversal in Wallos subscription tracker versions prior to 4.6.2 allows unauthenticated remote attackers to read ar
Reflected cross-site scripting (XSS) in Wallos password reset functionality before version 4.6.2 allows unauthenticated
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excludi
Zip Slip path traversal in Wallos's database restore endpoint allows an authenticated administrator to write arbitrary f
Wallos, an open-source self-hostable subscription tracker, contains a Server-Side Request Forgery (SSRF) vulnerability i
Wallos prior to version 4.6.2 contains an authorization bypass allowing authenticated users to delete avatar files belon
Wallos versions prior to 4.6.2 contain a server-side request forgery (SSRF) vulnerability in the webhook notification te
Exploit-DB