Authentication Bypass in Wallos Personal Subscription Tracker by Elite

CVE-2026-61641

What is CVE-2026-61641?

Wallos, an open-source personal subscription tracker, is vulnerable due to its handling of OIDC login links. From versions 4.0.0 to below 4.9.6, the application associates an incoming OIDC identity with an existing user account based solely on the email claim, neglecting to verify if the identity provider (IdP) confirmed the email as verified. This is especially risky when using multi-tenant IdPs or any IdP that allows user self-registration. Consequently, an attacker can log in as an admin by simply supplying an admin email, bypassing the need for a password and enabling full account access. The issue has been addressed in version 4.9.6.

References