# CVE-2026-54599: Wallos OIDC state validation missing in login CSRF

Source: https://junglewise.ai/threats/cve-2026-54599-wallos-oidc-state-validation-missing-in-login-csrf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54599 · Severity: info · Published 2026-08-31

Wallos is an open-source subscription tracker that allows administrators to enable single sign-on (SSO) using OIDC authentication. Prior to version 4.9.4, the application fails to validate that login callbacks come from the user's own authentication session, allowing an attacker to trick a victim into logging into the attacker's account by sending a specially crafted link. This could result in account takeover and unauthorized access to a victim's subscription management data.

Technologies: [Ellite Wallos](https://junglewise.ai/threats/technologies/wallos). Vendors: [Ellite](https://junglewise.ai/threats/vendors/ellite).

## Quick answers

**Is CVE-2026-54599 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54599 being exploited in the wild.

**How severe is CVE-2026-54599?** Informational severity, published 31 August 2026.

**Which products and versions are affected?** Ellite Wallos prior to 4.9.4.

**Is there a fix for CVE-2026-54599?** A patch was published on 2026-06-06: Version 4.9.4 released but marked as broken; fixed in v4.9.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54599 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54599?** Check whether you run Ellite Wallos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CSRF (Cross-Site Request Forgery) attack in the OIDC login flow, classified as CWE-352. The root cause is that login.php generates an OIDC state nonce and stores it in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback (lines 13-18) without validating the incoming state parameter against the session value. An attacker can obtain their own authorization code from the IdP and send a victim a crafted URL containing their code and an arbitrary state value. When the victim visits this URL, Wallos exchanges the attacker's code for an identity token and logs the victim into the attacker's account. The vulnerability requires OIDC to be admin-enabled (non-default). The fix, released in v4.9.4, adds state validation before dispatching the callback.

## Affected products

- ellite Wallos prior to 4.9.4

## Timeline

- 2026-06-09: disclosed
- 2026-06-06: patched: Version 4.9.4 released but marked as broken; fixed in v4.9.5

## References

- [https://github.com/ellite/Wallos/releases/tag/v4.9.4](https://github.com/ellite/Wallos/releases/tag/v4.9.4)
- [https://github.com/ellite/Wallos/security/advisories/GHSA-gr2w-m9v4-qm3v](https://github.com/ellite/Wallos/security/advisories/GHSA-gr2w-m9v4-qm3v)

## Related threats

- [Wallos CRLF injection in iCalendar export](https://junglewise.ai/threats/cve-2026-77353-wallos-crlf-injection-in-icalendar-export)
- [Wallos OIDC account takeover via unverified email linking](https://junglewise.ai/threats/cve-2026-61641-wallos-oidc-account-takeover-via-unverified-email-linking)
- [Wallos unauthenticated database migration execution](https://junglewise.ai/threats/cve-2026-54598-wallos-unauthenticated-database-migration-execution)
- [Wallos incorrect authorization in exchange-rate refresh](https://junglewise.ai/threats/cve-2026-50199-wallos-incorrect-authorization-in-exchange-rate-refresh)
- [Wallos cross-user subscription cost inference via replacement_subscription_id](https://junglewise.ai/threats/cve-2026-50198-wallos-cross-user-subscription-cost-inference-via-replacement)