What’s Vulnerable › Vulnerabilities

CVE-2026-54599: Wallos: OIDC state parameter never validated — login CSRF / account takeover

• Severity: high (CVSS 7.5 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-31 · updated 2026-09-08
• Weakness: CWE-352

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account. This issue has been patched in version 4.9.4.

Affected products

• ellite Wallos: before 4.9.4

References

• https://github.com/ellite/Wallos/releases/tag/v4.9.4
• https://github.com/ellite/Wallos/security/advisories/GHSA-gr2w-m9v4-qm3v
• https://github.com/ellite/Wallos/security/advisories/GHSA-gr2w-m9v4-qm3v

Get alerted when CVE-2026-54599 or the next vulnerability affects your stack