CVE-2026-54599: falha de alta gravidade em ellite Wallos
Wallos: OIDC state parameter never validated — login CSRF / account takeover
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.2%
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account. This issue has been patched in version 4.9.4.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ellite · WallosCVEs relacionadas — ellite Wallos
No mesmo produto, das mais perigosas para as menos.
CVE-2026-54600HIGHWallos: Unauthenticated database replacement via import endpoint on fresh installEPSS 0.6%CVE-2026-30828HIGHWallos: SSRF via url parameter leading to File TraversalEPSS 0.6%CVE-2026-61640HIGHWallos: SSRF via OIDC Token/UserInfo URL ConfigurationEPSS 0.5%CVE-2026-61641HIGHWallos: OIDC account takeover via email-based account linking without `email_verified` checkEPSS 0.5%CVE-2026-61639HIGHWallos: Zip Slip path traversal in database restore writes files to webrootEPSS 0.5%CVE-2026-61638HIGHWallos: SSRF via Test Email Notification - unvalidated SMTP host/portEPSS 0.5%