Password Reset Token Vulnerability in Wallos Subscription Tracker
CVE-2026-33417

6.5MEDIUM

Key Information:

Vendor

Ellite

Status
Wallos
Vendor
CVE Published:
24 March 2026

What is CVE-2026-33417?

Wallos, an open-source personal subscription tracker, has a serious flaw in its password reset mechanism. Prior to version 4.7.2, password reset tokens generated by Wallos do not have an expiration time, allowing them to remain valid indefinitely. This oversight means that if an attacker intercepts a reset link, they can exploit it at any point in the future, leading to unauthorized access to user accounts. The issue has been addressed in the latest software update, version 4.7.2, which implements proper expiration checks for password reset tokens.

Affected Version(s)

Wallos < 4.7.2

References

https://github.com/ellite/Wallos/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/ellite/Wallos/commit/90bb6186ee4091590...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.