Open-Source Personal Subscription Tracker Vulnerability in Wallos

CVE-2026-54599

What is CVE-2026-54599?

Wallos, an open-source personal subscription tracker, has a vulnerability in its authentication flow prior to version 4.9.4. The issue arises from the improper handling of OIDC state nonce in the login process. When a user logs in, the nonce is stored in the session, but subsequent checks against this state during OIDC callbacks are not performed. This oversight allows an attacker to create a malicious URL that, when visited by a victim, can successfully manipulate the authorization process. As a result, the attacker can gain unauthorized access to the victim's account by leveraging the victim's login action. This vulnerability has been addressed in the latest version, 4.9.4.

References