Executive brief
Wallos is an open-source subscription tracker that allows administrators to enable single sign-on (SSO) using OIDC authentication. Prior to version 4.9.4, the application fails to validate that login callbacks come from the user's own authentication session, allowing an attacker to trick a victim into logging into the attacker's account by sending a specially crafted link. This could result in account takeover and unauthorized access to a victim's subscription management data.
Technical details
The vulnerability is a CSRF (Cross-Site Request Forgery) attack in the OIDC login flow, classified as CWE-352. The root cause is that login.php generates an OIDC state nonce and stores it in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback (lines 13-18) without validating the incoming state parameter against the session value. An attacker can obtain their own authorization code from the IdP and send a victim a crafted URL containing their code and an arbitrary state value. When the victim visits this URL, Wallos exchanges the attacker's code for an identity token and logs the victim into the attacker's account. The vulnerability requires OIDC to be admin-enabled (non-default). The fix, released in v4.9.4, adds state validation before dispatching the callback.
Affected products
- ellite Wallos prior to 4.9.4
Timeline
- 2026-06-09: disclosed
- 2026-06-06: patched: Version 4.9.4 released but marked as broken; fixed in v4.9.5