CVE-2026-54599

Received Received - Intake

OIDC State Mismatch in Wallos Leading to Account Takeover

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account. This issue has been patched in version 4.9.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-54599

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	wallos	to 4.9.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Wallos is a self-hosted subscription tracker. Before version 4.9.4, login.php created an OIDC state nonce stored in the session but checksession.php did not verify the incoming state against this session value. This allowed an attacker to craft a URL that would make Wallos exchange the attacker's authorization code for the victim's session, logging the victim into the attacker's account.

Detection Guidance

This vulnerability involves a session state mismatch in Wallos versions prior to 4.9.4. To detect it, check if your Wallos instance is running a version older than 4.9.4. Use commands like 'docker inspect <container_name> | grep VERSION' for Docker deployments or inspect the version file in the Wallos directory for manual installations.

Impact Analysis

An attacker could gain unauthorized access to your Wallos account by tricking you into clicking a malicious link. This could expose your subscription details, personal data, and other sensitive information stored in your account.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and potentially HIPAA if health-related subscription data is exposed. It undermines user consent and data integrity requirements.

Mitigation Strategies

Upgrade Wallos to version 4.9.4 or later immediately. For Docker, pull the latest image with 'docker pull wallos/wallos:latest' and restart the container. For manual installations, replace the codebase with the patched version from the official repository.

Hi! I’m here to help you understand CVE-2026-54599. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70