CVE-2026-61640

Wallos, an open-source, self-hosted personal subscription tracker, contains a server-side request forgery (CWE-918) in its OIDC login handling: the admin-configured token_url and user_info_url values are passed directly to curl_init() in includes/oidc/handle_oidc_callback.php (lines 18-49) with no SSRF filtering, unlike logo and webhook URLs which are checked with validate_webhook_url_for_ssrf(). Because the vector requires high privileges (CVSS 4.0 PR:H), exploitation means an attacker who already has administrator access sets these URLs to an internal endpoint such as the cloud metadata service at http://169.254.169.254/latest/meta-data/ and then lets the OIDC callback run, causing the Wallos server to fetch the chosen URLs. From there the attacker gains access to cloud instance metadata (potentially including instance credentials) and can use the server as a foothold to probe or pivot into the internal network, which is why the issue is rated High (8.5). Any Wallos deployment prior to version 4.9.6 is affected, but practically only instances where an admin has configured OIDC login. No public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation are known; EPSS currently estimates a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to Wallos 4.9.6 or later, which adds SSRF validation for the OIDC token_url and user_info_url. Until then, restrict those OIDC URLs to trusted HTTPS endpoints and block outbound access from the Wallos host or container to 169.254.169.254 and internal network ranges; if the instance runs in a cloud environment, review credentials reachable via instance metadata. Also confirm which admins can change OIDC settings, since the flaw requires administrator-level access to trigger.