CVE-2026-61640: Wallos: SSRF via OIDC Token/UserInfo URL Configuration
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC tokenurl and userinfourl in includes/oidc/handleoidccallback.php:18-49 are used directly in curlinit() with zero SSRF filtering. Unlike logo/webhook URLs which have validatewebhookurlforssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 4.9.6 - Compensating control
Because OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php are used directly in curl_init() without SSRF filtering, restrict outbound network access from the Wallos server (egress) so it cannot reach internal metadata services such as http://169.254.169.254/latest/meta-data/ and other internal pivot targets.
Event History
Frequently Asked Questions
Who can exploit this issue?
An administrator who can configure the OIDC token_url or user_info_url can cause the Wallos server to make requests to attacker-selected URLs. This can expose cloud instance metadata services or enable access to internal network endpoints reachable from the server.
Are default installations affected?
The issue requires OIDC URL configuration by an administrator. The provided information does not indicate that default OIDC settings alone trigger the behavior.
What versions should be remediated?
Wallos versions prior to 4.9.6 are affected. Upgrade to version 4.9.6, which patches the issue.
What can be done before upgrading?
Restrict access to Wallos administrative OIDC configuration and do not set token_url or user_info_url values that point to internal, link-local, or cloud metadata addresses. Network egress controls can also limit the server's ability to reach sensitive internal services.