SSRF Vulnerability in Wallos Open-Source Subscription Tracker
CVE-2026-61640

8.5HIGH

Key Information:

Vendor

Ellite

Status
Wallos
Vendor
CVE Published:
31 August 2026

What is CVE-2026-61640?

Wallos, an open-source personal subscription tracker, contains a vulnerability that allows for Server-Side Request Forgery (SSRF). Prior to version 4.9.6, the Admin-configured OIDC token_url and user_info_url were directly passed to curl_init() without any SSRF filtering. This lack of filtering meant that an attacker could manipulate the OIDC URLs for accessing sensitive cloud metadata or for internal network pivoting, potentially leading to exposure of critical information. The vulnerability has been addressed in version 4.9.6, with necessary protections implemented to validate OIDC URLs.

Affected Version(s)

Wallos < 4.9.6

References

https://github.com/ellite/Wallos/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/ellite/Wallos/pull/1092
x_refsource_MISC
https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e7...
x_refsource_MISC

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.