Executive brief
Wallos is an open-source subscription management application that allows administrators to configure OpenID Connect (OIDC) authentication. Prior to version 4.9.6, attackers with admin access could exploit a server-side request forgery (SSRF) vulnerability by configuring malicious OIDC token and user info URLs. An admin could point these URLs to internal cloud metadata endpoints or internal network resources, allowing the application to retrieve sensitive credentials or access restricted systems.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the OIDC callback handler at includes/oidc/handle_oidc_callback.php (lines 18–49). Admin-configured token_url and user_info_url parameters are passed directly to curl_init() without any validation or filtering. Unlike other URL inputs (logo/webhook URLs) that validate using validate_webhook_url_for_ssrf(), the OIDC URLs bypass all protections. An attacker with admin privileges can configure these URLs to point to internal cloud metadata services (e.g., http://169.254.169.254/latest/meta-data/) or internal network resources. The fix was applied in version 4.9.6 by hardening OIDC state validation and adding SSRF protections.
Affected products
- Wallos Wallos before 4.9.6
Timeline
- 2026-06-22: patched: Version 4.9.6 released with SSRF fix