EUVD-2026-68812Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered OIDC callback requires no Wallos credentials (PR:N) but depends on a permissive IdP configuration (AC:H); full admin account takeover justifies C:H/I:H/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin - full account takeover, no password needed. This issue has been patched in version 4.9.6.
AnalysisAI
Full account takeover in Wallos 4.0.0-4.9.5 is possible via OIDC authentication bypass when the application links an incoming OIDC identity to an existing local account using only the email claim, ignoring whether the IdP marked that email as verified via the email_verified flag. An attacker operating on a multi-tenant or open-registration IdP trusted by the target Wallos instance can claim the administrator's email, trigger the OIDC login flow, and be granted full admin access with no password or prior Wallos credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that OIDC login be explicitly enabled in Wallos and that an IdP be configured - this is a non-default, operator-chosen configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) captures a high-severity flaw with network delivery, no required credentials, and full CIA impact, tempered by AC:H because exploitation depends on an IdP configuration that permits unverified email claims. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Wallos version 4.9.6, released 2026-06-22 via https://github.com/ellite/Wallos/releases/tag/v4.9.6, which resolves account takeover via email-based account linking and additionally hardens OIDC state validation and session rotation (commit b75f13d). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify whether your Wallos instance has OIDC authentication enabled; if so, immediately audit the identity provider's email claim policy to determine if unverified email addresses can be claimed by potential attackers-if yes, disable OIDC authentication and require all users to authenticate via local credentials until a patch is available. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to res
Server-side request forgery in Wallos versions before 4.6.2 allows authenticated attackers to conduct arbitrary network
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php. R
Wallos versions 4.6.0 and below allow authenticated attackers to perform Server-Side Request Forgery attacks through the
Path traversal in Wallos subscription tracker versions prior to 4.6.2 allows unauthenticated remote attackers to read ar
Reflected cross-site scripting (XSS) in Wallos password reset functionality before version 4.6.2 allows unauthenticated
Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excludi
Zip Slip path traversal in Wallos's database restore endpoint allows an authenticated administrator to write arbitrary f
SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct th
Wallos, an open-source self-hostable subscription tracker, contains a Server-Side Request Forgery (SSRF) vulnerability i
Wallos prior to version 4.6.2 contains an authorization bypass allowing authenticated users to delete avatar files belon
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today