Is CVE-2026-61640 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61640 being exploited in the wild.

How severe is CVE-2026-61640?

Informational severity, published 31 August 2026.

Is there a fix for CVE-2026-61640?

A patch was published on 2026-06-22: Version 4.9.6 released with SSRF fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61640 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61640?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61640: Wallos SSRF in OIDC configuration

CVE-2026-61640 · Severity: info · Published 2026-08-31

Wallos is an open-source subscription management application that allows administrators to configure OpenID Connect (OIDC) authentication. Prior to version 4.9.6, attackers with admin access could exploit a server-side request forgery (SSRF) vulnerability by configuring malicious OIDC token and user info URLs. An admin could point these URLs to internal cloud metadata endpoints or internal network resources, allowing the application to retrieve sensitive credentials or access restricted systems.

Quick answers

Is CVE-2026-61640 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61640 being exploited in the wild.
How severe is CVE-2026-61640?: Informational severity, published 31 August 2026.
Which products and versions are affected?: Wallos Wallos before 4.9.6.
Is there a fix for CVE-2026-61640?: A patch was published on 2026-06-22: Version 4.9.6 released with SSRF fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61640 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61640?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in the OIDC callback handler at includes/oidc/handle_oidc_callback.php (lines 18–49). Admin-configured token_url and user_info_url parameters are passed directly to curl_init() without any validation or filtering. Unlike other URL inputs (logo/webhook URLs) that validate using validate_webhook_url_for_ssrf(), the OIDC URLs bypass all protections. An attacker with admin privileges can configure these URLs to point to internal cloud metadata services (e.g., http://169.254.169.254/latest/meta-data/) or internal network resources. The fix was applied in version 4.9.6 by hardening OIDC state validation and adding SSRF protections.

Affected products

Wallos Wallos before 4.9.6

Timeline

2026-06-22: patched: Version 4.9.6 released with SSRF fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.