CyberRota Analysis
AI-GeneratedWallos versions prior to 4.9.6 are vulnerable due to improper handling of OIDC token and user info URLs, allowing for Server-Side Request Forgery (SSRF) attacks. This flaw enables an attacker to exploit the application to access sensitive internal resources or cloud metadata, potentially leading to unauthorized data exposure or network pivoting. Organizations using Wallos should prioritize updating to version 4.9.6 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.