CVE-2026-61641

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.

• CWE-287

• https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3
• https://github.com/ellite/Wallos/pull/1092
• https://github.com/ellite/Wallos/releases/tag/v4.9.6
• https://github.com/ellite/Wallos/security/advisories/GHSA-qwgp-m2f3-6j3r

Published

Aug 31, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61632PyMdown Extensions is a set of extensions for the Python-Mar…5.3
• CVE-2026-61634The RabbitMQ Java client library allows Java and JVM-based a…0
• CVE-2026-61638Wallos is an open-source, self-hostable personal subscriptio…8.2
• CVE-2026-61639Wallos is an open-source, self-hostable personal subscriptio…8.5
• CVE-2026-6164A security flaw has been discovered in code-projects Lost an…7.3
• CVE-2026-61640Wallos is an open-source, self-hostable personal subscriptio…8.5
• CVE-2026-61643FastGPT is a knowledge-based AI application platform. From 4…5.9
• CVE-2026-61644FastGPT is a knowledge-based AI application platform. From 4…7.7
• CVE-2026-61646FastGPT is a knowledge-based AI application platform. Prior …6.3
• CVE-2026-6165A weakness has been identified in code-projects Vehicle Show…7.3
• CVE-2026-6166A security vulnerability has been detected in code-projects …7.3
• CVE-2026-61663django CMS is an easy-to-use and developer-friendly enterpri…4.3