CVE-2026-61641: Wallos: OIDC account takeover via email-based account linking without `email_verified` check
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (emailverified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallosto a version that resolves this vulnerability.Fixed in 4.9.6
Event History
Frequently Asked Questions
Which deployments are realistically exposed to account takeover?
Wallos versions 4.0.0 through 4.9.5 are exposed when OIDC is configured with an identity provider that permits arbitrary or unverified email claims. This includes multi-tenant IdPs, IdPs offering open self-registration, and IdPs that an attacker can partly control.
What does an attacker need to exploit this issue?
The attacker does not need a Wallos account or the target's password. They need to authenticate through the configured OIDC provider while presenting the email address of an existing Wallos account, such as the administrator's, without that email being verified by the IdP.
How can this be remediated?
Upgrade Wallos to version 4.9.6 or later, which patches the missing email_verified validation. Until patching is possible, avoid using OIDC providers that allow users to supply unverified or arbitrary email addresses.
How can I determine whether my environment is affected?
Check whether Wallos is running a version from 4.0.0 through 4.9.5 and whether OIDC login is enabled. Then assess whether the configured IdP can issue login identities with unverified or attacker-controlled email claims matching existing Wallos users.