Executive brief
Wallos is an open-source subscription tracker that supports single sign-on via OIDC identity providers. Due to insufficient email verification during account linking, an attacker can register with an admin's email address at a multi-tenant or self-registration-enabled identity provider, then authenticate to Wallos as the admin without knowing the password. This results in complete account takeover with administrative privileges.
Technical details
The vulnerability is an authentication bypass in OIDC account linking logic. When a user authenticates via OIDC, Wallos matches the incoming email claim to an existing local account without verifying the IdP's email_verified flag. An attacker controlling or gaining access to an IdP that permits unverified or arbitrary email claims (such as a multi-tenant IdP, open self-registration, or a compromised IdP) can present the admin's email address during authentication and be granted access as that admin. The vulnerability affects versions 4.0.0 through 4.9.5; patching requires verifying the email_verified claim from the IdP before linking accounts. No authentication or special user interaction is required beyond redirecting to the vulnerable OIDC flow.
Affected products
- ellite Wallos 4.0.0 to 4.9.5
Timeline
- 2026-08-31: disclosed: CVE-2026-61641 published
- 2026-06-22: patched: Version 4.9.6 released with fix for email_verified verification