CVE-2026-61640

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.

• CWE-918

• https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3
• https://github.com/ellite/Wallos/pull/1092
• https://github.com/ellite/Wallos/releases/tag/v4.9.6
• https://github.com/ellite/Wallos/security/advisories/GHSA-x9x5-gh69-q7cm

Published

Aug 31, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6163A vulnerability was identified in code-projects Lost and Fou…7.3
• CVE-2026-61632PyMdown Extensions is a set of extensions for the Python-Mar…5.3
• CVE-2026-61634The RabbitMQ Java client library allows Java and JVM-based a…0
• CVE-2026-61638Wallos is an open-source, self-hostable personal subscriptio…8.2
• CVE-2026-61639Wallos is an open-source, self-hostable personal subscriptio…8.5
• CVE-2026-6164A security flaw has been discovered in code-projects Lost an…7.3
• CVE-2026-61641Wallos is an open-source, self-hostable personal subscriptio…8.1
• CVE-2026-61643FastGPT is a knowledge-based AI application platform. From 4…5.9
• CVE-2026-61644FastGPT is a knowledge-based AI application platform. From 4…7.7
• CVE-2026-61646FastGPT is a knowledge-based AI application platform. Prior …6.3
• CVE-2026-6165A weakness has been identified in code-projects Vehicle Show…7.3
• CVE-2026-6166A security vulnerability has been detected in code-projects …7.3