# CVE-2026-61641: Wallos OIDC account takeover via unverified email linking

Source: https://junglewise.ai/threats/cve-2026-61641-wallos-oidc-account-takeover-via-unverified-email-linking  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61641 · Severity: high · CVSS 8.1 · Published 2026-08-31

Wallos is an open-source subscription tracker that supports single sign-on via OIDC identity providers. Due to insufficient email verification during account linking, an attacker can register with an admin's email address at a multi-tenant or self-registration-enabled identity provider, then authenticate to Wallos as the admin without knowing the password. This results in complete account takeover with administrative privileges.

Technologies: [Ellite Wallos](https://junglewise.ai/threats/technologies/wallos). Vendors: [Ellite](https://junglewise.ai/threats/vendors/ellite).

## Quick answers

**Is CVE-2026-61641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61641 being exploited in the wild.

**How severe is CVE-2026-61641?** High severity, with a CVSS score of 8.1, published 31 August 2026.

**Which products and versions are affected?** Ellite Wallos 4.0.0 to 4.9.5.

**Is there a fix for CVE-2026-61641?** A patch was published on 2026-06-22: Version 4.9.6 released with fix for email_verified verification Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61641 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-61641?** Check whether you run Ellite Wallos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in OIDC account linking logic. When a user authenticates via OIDC, Wallos matches the incoming email claim to an existing local account without verifying the IdP's email_verified flag. An attacker controlling or gaining access to an IdP that permits unverified or arbitrary email claims (such as a multi-tenant IdP, open self-registration, or a compromised IdP) can present the admin's email address during authentication and be granted access as that admin. The vulnerability affects versions 4.0.0 through 4.9.5; patching requires verifying the email_verified claim from the IdP before linking accounts. No authentication or special user interaction is required beyond redirecting to the vulnerable OIDC flow.

## Affected products

- ellite Wallos 4.0.0 to 4.9.5

## Timeline

- 2026-08-31: disclosed: CVE-2026-61641 published
- 2026-06-22: patched: Version 4.9.6 released with fix for email_verified verification

## References

- [https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3](https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3)
- [https://github.com/ellite/Wallos/pull/1092](https://github.com/ellite/Wallos/pull/1092)

## Related threats

- [Wallos CRLF injection in iCalendar export](https://junglewise.ai/threats/cve-2026-77353-wallos-crlf-injection-in-icalendar-export)
- [Wallos OIDC state validation missing in login CSRF](https://junglewise.ai/threats/cve-2026-54599-wallos-oidc-state-validation-missing-in-login-csrf)
- [Wallos unauthenticated database migration execution](https://junglewise.ai/threats/cve-2026-54598-wallos-unauthenticated-database-migration-execution)
- [Wallos incorrect authorization in exchange-rate refresh](https://junglewise.ai/threats/cve-2026-50199-wallos-incorrect-authorization-in-exchange-rate-refresh)
- [Wallos cross-user subscription cost inference via replacement_subscription_id](https://junglewise.ai/threats/cve-2026-50198-wallos-cross-user-subscription-cost-inference-via-replacement)