CyberRota Analysis
AI-GeneratedWallos versions 4.0.0 to 4.9.5 are vulnerable due to a flaw in their OIDC login process, which allows an attacker to authenticate as an admin by exploiting unverified email claims from certain identity providers. This vulnerability can lead to full account takeover without requiring a password, posing a significant risk to users of Wallos, particularly those using multi-tenant or self-registration identity providers. Organizations using affected versions should prioritize upgrading to version 4.9.6 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.