CVE-2026-33417: Wallos: Password Reset Tokens Never Expire
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The passwordresets table includes a createdat timestamp column, but the token validation logic never checks it. A password reset token remains valid indefinitely until it is used, allowing an attacker who intercepts a reset link at any point to use it days, weeks, or months later. This issue has been patched in version 4.7.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33417?
CVE-2026-33417 is considered to be a high severity vulnerability due to the risk of unauthorized access through unexpired password reset tokens.
How do I fix CVE-2026-33417?
To fix CVE-2026-33417, upgrade Wallos to version 4.7.2 or later where the password reset token expiration logic has been implemented.
What are the risks associated with CVE-2026-33417?
The risks associated with CVE-2026-33417 include potential account takeover if a password reset link is exploited beyond its intended expiration.
Which versions of Wallos are affected by CVE-2026-33417?
Wallos versions prior to 4.7.2 are affected by CVE-2026-33417, where password reset tokens do not expire.
Can CVE-2026-33417 be exploited remotely?
Yes, CVE-2026-33417 can be exploited remotely, allowing attackers to potentially reset user passwords if they have access to the reset tokens.