Vulnerability · Published Aug 31, 2026 · Assigned by GitHub_M

CVE-2026-61640Wallos: SSRF via OIDC Token/UserInfo URL Configuration

High 8.5

In plain English

A high-severity server-side request forgery in Wallos from ellite. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.5%top 54.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.

Affected products (as reported)

Vendor	Product	Versions
ellite	Wallos	< 4.9.6

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/ellite/Wallos/security/advisories/GHSA-x9x5-gh69-q7cm x_refsource_CONFIRM
https://github.com/ellite/Wallos/pull/1092 x_refsource_MISC
https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3 x_refsource_MISC
https://github.com/ellite/Wallos/releases/tag/v4.9.6 x_refsource_MISC