CVE-2026-54599: Wallos OIDC Authentication Bypass Vulnerability

CVE-2026-54599 Overview

CVE-2026-54599 is an authentication flaw in Wallos, an open-source self-hostable personal subscription tracker. Versions prior to 4.9.4 generate an OpenID Connect (OIDC) state nonce in login.php and store it in $_SESSION['oidc_state'], but checksession.php never compares the incoming state parameter against the session-stored value during the OIDC callback. This missing validation allows an attacker to force a victim to authenticate into an attacker-controlled account by exchanging a crafted authorization code. The maintainers patched the issue in Wallos version 4.9.4. The weakness is tracked as CWE-352: Cross-Site Request Forgery.

Critical Impact
A victim visiting a crafted URL is silently logged into the attacker's Wallos account, exposing any subscription data the victim subsequently enters to the attacker.

Affected Products

Wallos (self-hosted personal subscription tracker) versions prior to 4.9.4
Wallos login.php OIDC initiation flow
Wallos checksession.php OIDC callback handler

Discovery Timeline

2026-08-31 - CVE-2026-54599 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-54599

Vulnerability Analysis

CVE-2026-54599 is a login CSRF via a broken OIDC state check. The OIDC specification requires the relying party to bind an unguessable state value to the user's session at authorization request time and verify that same value on the callback. Wallos implements the first half but omits the second. login.php generates a nonce and stores it in $_SESSION['oidc_state'], yet checksession.php processes the callback (including the authorization code exchange) without validating the returned state parameter against the session copy.

Because the callback proceeds regardless of state, any authorization code accepted by the identity provider will be exchanged, and the resulting identity is bound to the victim's browser session. An attacker who completes the initial OIDC step against their own identity, captures the resulting authorization code, and then induces a victim to load a callback URL containing that code can pin the victim's Wallos session to the attacker's account.

Root Cause

The root cause is missing anti-CSRF state validation in the OIDC callback path. The application generates state material but never enforces the equality check between the callback state query parameter and $_SESSION['oidc_state']. This is a direct instance of CWE-352 in a federated authentication flow.

Attack Vector

Exploitation requires network reachability to the Wallos instance and user interaction. The attacker initiates an OIDC login, intercepts or captures the authorization code returned by the identity provider, and constructs a callback URL that references that code. When the victim is tricked into visiting the crafted link, checksession.php exchanges the attacker's code and binds the attacker's identity to the victim's session. Any subscriptions, notes, or financial metadata the victim then records are visible to the attacker upon login. Full technical details are available in the GitHub Security Advisory GHSA-gr2w-m9v4-qm3v.

Detection Methods for CVE-2026-54599

Indicators of Compromise

Requests to checksession.php containing an OIDC code and state parameter where the state value does not correspond to any recently issued session nonce.
OIDC callbacks originating from referrers unrelated to the Wallos login page or external short-link services.
Unexpected changes in the logged-in user identity (email, subject claim) tied to a persistent browser session on the same host.

Detection Strategies

Enable verbose logging on login.php and checksession.php and correlate the issued oidc_state value with the state parameter observed at callback time.
Review authentication provider logs for token exchanges paired with Wallos callbacks that were not preceded by a matching authorization request from the victim's IP.
Inspect web server access logs for successive requests to /checksession.php?code=...&state=... followed by session activity attributed to a new user identity.

Monitoring Recommendations

Alert on high-frequency OIDC callback requests from a single client that arrive without a preceding /login.php request in the same session.
Monitor for Wallos user accounts that log in from geographically inconsistent locations relative to the tenant's normal patterns.
Ingest Wallos web logs into a centralized analytics platform and build a rule for callback events missing the expected state binding.

How to Mitigate CVE-2026-54599

Immediate Actions Required

Upgrade Wallos to version 4.9.4 or later using the release available at the Wallos v4.9.4 release page.
Invalidate all active Wallos sessions after upgrade to force re-authentication through the patched callback flow.
Rotate OIDC client secrets and audit the identity provider for authorization codes issued to unexpected redirect URIs.

Patch Information

Wallos version 4.9.4 introduces the missing state comparison in checksession.php, ensuring the callback rejects any request whose state parameter does not match $_SESSION['oidc_state']. Refer to the GitHub Security Advisory GHSA-gr2w-m9v4-qm3v for advisory metadata and to the v4.9.4 release notes for the applied fix.

Workarounds

If immediate upgrade is not possible, disable the OIDC authentication method in Wallos and require local credentials until the patched version is deployed.
Restrict access to the Wallos instance behind a VPN or authenticating reverse proxy so that unauthenticated callback URLs cannot be triggered by external victims.
Enforce short session lifetimes and require re-authentication for sensitive actions to limit the blast radius of a successful login CSRF.

bash

# Configuration example: upgrade a Docker-based Wallos deployment to v4.9.4
docker pull bellamy/wallos:4.9.4
docker stop wallos && docker rm wallos
docker run -d --name wallos -p 8282:80 -v wallos_data:/var/www/html/db bellamy/wallos:4.9.4