Vulnerability · Published Aug 31, 2026 · Assigned by GitHub_M

CVE-2026-54599Wallos: OIDC state parameter never validated — login CSRF / account takeover

High 7.5

In plain English

A high-severity cross-site request forgery in Wallos from ellite. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.2%top 87.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account. This issue has been patched in version 4.9.4.

Affected products (as reported)

Vendor	Product	Versions
ellite	Wallos	< 4.9.4

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/ellite/Wallos/security/advisories/GHSA-gr2w-m9v4-qm3v x_refsource_CONFIRM
https://github.com/ellite/Wallos/releases/tag/v4.9.4 x_refsource_MISC