CVE-2026-61641

Wallos, an open-source self-hosted personal subscription tracker, links an incoming OIDC identity to a local account using only the email claim, without checking that the identity provider marked the email as verified (email_verified). An attacker who can authenticate through an identity provider that lets them present an arbitrary or unverified email — such as a multi-tenant IdP, one with open self-registration, or an IdP they partly control — can log in with the administrator's email address with no password and take over the admin account. Successful exploitation grants full control of the affected Wallos instance's admin account, including its subscription and payment data. Only self-hosted Wallos instances running version 4.0.0 through before 4.9.6 with OIDC login enabled against a permissive identity provider are affected. There is no public proof of concept, no known in-the-wild exploitation, and the flaw is not in CISA KEV; it carries an EPSS score of about 0.3%.

What to do: Upgrade to Wallos 4.9.6 or later, which verifies the email_verified claim before linking identities. If upgrading is not immediately possible, disable OIDC login or restrict it to a trusted IdP configuration that guarantees email verification (e.g., a single-tenant provider that enforces verified addresses), and check admin account activity for unexpected logins. Admins on multi-tenant or open-registration IdPs should prioritize the update, since those configurations are directly exploitable.