Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M

CVE-2026-33417Wallos: Password Reset Tokens Never Expire

Medium 6.5

In plain English

A medium-severity security flaw in Wallos from ellite. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 80.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_resets table includes a created_at timestamp column, but the token validation logic never checks it. A password reset token remains valid indefinitely until it is used, allowing an attacker who intercepts a reset link at any point to use it days, weeks, or months later. This issue has been patched in version 4.7.2.

Affected products (as reported)

Vendor	Product	Versions
ellite	Wallos	< 4.7.2

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/ellite/Wallos/security/advisories/GHSA-p3fv-m43r-3fhf x_refsource_CONFIRM
https://github.com/ellite/Wallos/commit/90bb6186ee4091590b6efdef824c85f2494ff2bb x_refsource_MISC