CVE-2026-61640

Received Received - Intake

Server-Side Request Forgery in Wallos Self-Hosted Subscription Tracker

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-61640

Affected Vendors & Products

Vendor	Product	Version / Range
wallos	wallos	to 4.9.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Wallos is a self-hosted subscription tracker. Prior to version 4.9.6, it had a vulnerability where admin-configured OIDC token and user info URLs were used directly in curl requests without proper SSRF protection. This allowed attackers to manipulate these URLs to access internal networks or cloud metadata endpoints.

Detection Guidance

Check Wallos configuration files for OIDC token_url or user_info_url settings pointing to internal or cloud metadata endpoints like http://169.254.169.254/latest/meta-data/. Review includes/oidc/handle_oidc_callback.php for direct curl_init() usage without SSRF validation.

Impact Analysis

An attacker with admin access could exploit this to make the server send requests to internal systems or cloud metadata services. This could lead to data exfiltration, unauthorized access to sensitive services, or pivoting to other internal network resources.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Compliance may be compromised if sensitive data is exposed through this flaw.

Mitigation Strategies

Upgrade Wallos to version 4.9.6 or later. Review and remove any admin-configured OIDC URLs pointing to internal or cloud metadata endpoints. Ensure all OIDC URL inputs are validated with SSRF protections similar to logo/webhook URLs.

Hi! I’m here to help you understand CVE-2026-61640. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70