CVE-2026-54599: Wallos: OIDC state parameter never validated — login CSRF / account takeover
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $SESSION['oidcstate'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account. This issue has been patched in version 4.9.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 4.9.4
Event History
Frequently Asked Questions
Which deployments are affected?
Wallos deployments running versions prior to 4.9.4 are affected where OIDC login is used. Version 4.9.4 includes the fix.
What does an attacker need to exploit this issue?
The attacker needs an authorization code for their own OIDC account and must persuade a victim to visit a crafted URL. The callback accepts that code without validating that its state value matches the victim's login session.
What is the practical impact on a victim?
The victim can be logged into the attacker's Wallos account rather than their own. This creates a login CSRF condition that can lead to account takeover scenarios.
How can I determine whether my instance is vulnerable?
Review the installed Wallos version and the OIDC callback handling. Versions before 4.9.4 do not compare the incoming OIDC state parameter with the value stored in $_SESSION['oidc_state'].