CVE-2026-54599

Wallos, an open-source, self-hostable personal subscription tracker, prior to version 4.9.4 fails to validate the OpenID Connect (OIDC) 'state' parameter on the login callback: login.php stores a state nonce in $_SESSION['oidc_state'], but checksession.php dispatches the callback without comparing the incoming state to that stored session value (CWE-352, cross-site request forgery). An attacker exploits this by tricking a victim (user interaction is required, per the CVSS 4.0 vector) into visiting a crafted URL, after which Wallos exchanges the attacker's authorization code and logs the victim into the attacker's Wallos account. The outcome is a login CSRF: the victim's browser session is bound to the attacker's account, so activity or data the victim subsequently enters in Wallos can land in and be seen from the attacker's account. Only self-hosted Wallos deployments running a version before 4.9.4 and using the OIDC login flow are affected. There is no public proof of concept, the flaw is not in CISA's KEV, and EPSS assigns a 0.2% 30-day exploitation probability (7th percentile), so no exploitation is currently known.

What to do: Upgrade Wallos to version 4.9.4 or later, which adds the missing state comparison on the OIDC callback. Until you can patch, treat untrusted links cautiously while logged in and, if your deployment allows, temporarily disable the OIDC login path. After upgrading, verify the installed version reflects 4.9.4.