CVE-2026-61641: Wallos OIDC Authentication Bypass Vulnerability

CVE-2026-61641 Overview

Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.0.0 through 4.9.5 contain an authentication bypass flaw in the OpenID Connect (OIDC) login flow. The application links an incoming OIDC identity to an existing local account by matching the email claim alone, without checking whether the identity provider (IdP) marked the email as verified via the email_verified claim.

When Wallos is configured against an IdP that permits users to present arbitrary or unverified email addresses, an attacker without a Wallos account can authenticate using the administrator's email and gain admin access. The issue is patched in version 4.9.6 [CWE-287].

Critical Impact
Attackers can achieve full administrator account takeover without knowing the target password, provided the linked IdP does not enforce email verification.

Affected Products

Wallos versions 4.0.0 through 4.9.5
Deployments configured with multi-tenant IdPs or IdPs allowing self-registration
Any Wallos instance using OIDC login where the IdP does not enforce email verification

Discovery Timeline

2026-08-31 - CVE-2026-61641 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-61641

Vulnerability Analysis

The vulnerability resides in Wallos's OIDC login handler. When a user completes an OIDC authentication flow, Wallos reads the email claim from the identity token and searches for a matching local account. If a match is found, the OIDC identity is bound to that account and a session is issued.

The handler does not check the email_verified boolean claim defined by the OpenID Connect Core specification. An IdP that allows users to set an unverified email address, or one that an attacker partially controls, will emit tokens carrying the attacker's chosen email value. Wallos treats this claim as authoritative proof of identity ownership.

Root Cause

The authentication logic performs identity linking based on a single, unverified attribute. The OIDC specification treats email as a mutable, user-supplied claim and requires relying parties to consult email_verified before granting trust. Wallos's pre-4.9.6 code omitted this validation and lacked an administrator-configurable toggle to require verified emails.

Attack Vector

An unauthenticated attacker registers or authenticates at an IdP that Wallos trusts. The attacker sets their profile email to the address of the Wallos administrator. The attacker then initiates the OIDC login against Wallos. Wallos receives an ID token containing the administrator's email, matches the local admin account, and issues an authenticated session with administrator privileges.

php

// Patch: adds require_email_verified setting (default enabled)
// Source: https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3
        'scopes' => 'openid email profile',
        'auth_style' => 'auto',
        'auto_create_user' => 0,
-        'password_login_disabled' => 0
+        'password_login_disabled' => 0,
+        'require_email_verified' => 1
    ];
+} else {
+    // Column added via ALTER TABLE may return NULL for existing rows in SQLite
+    $oidcSettings['require_email_verified'] = $oidcSettings['require_email_verified'] ?? 1;
}

The patch introduces the require_email_verified configuration flag, defaulting to 1, so Wallos rejects OIDC callbacks where email_verified is not true.

Detection Methods for CVE-2026-61641

Indicators of Compromise

OIDC login events for administrator accounts originating from IdPs or subjects not previously associated with that account.
New administrator session activity without a corresponding password authentication event in Wallos logs.
Configuration changes, exported data, or new users created by the administrator account shortly after an OIDC callback from an unfamiliar sub (subject) identifier.

Detection Strategies

Review Wallos application logs for OIDC login callbacks where the ID token email_verified claim was absent or false.
Correlate IdP-side sign-in logs with Wallos admin logins to detect mismatched subject identifiers reusing the admin's email address.
Audit connected IdPs for self-registration policies or tenants that allow users to set arbitrary email addresses.

Monitoring Recommendations

Alert on any OIDC-initiated privilege elevation or first-time OIDC binding to a pre-existing administrator account.
Track Wallos version in inventory and flag hosts running 4.0.0 through 4.9.5.
Forward Wallos and reverse-proxy access logs to a centralized SIEM for retention and correlation with IdP telemetry.

How to Mitigate CVE-2026-61641

Immediate Actions Required

Upgrade Wallos to version 4.9.6 or later, which enforces the require_email_verified check by default.
Rotate administrator credentials and invalidate active sessions after upgrading.
Review the connected IdP configuration and disable self-registration or restrict tenants that permit unverified email claims.

Patch Information

The fix is delivered in Wallos v4.9.6 via pull request #1092 and commit b75f13d. See the GitHub Security Advisory GHSA-qwgp-m2f3-6j3r for full details.

Workarounds

Disable OIDC login until the upgrade to 4.9.6 is completed.
Restrict Wallos OIDC integration to a single-tenant IdP that enforces domain-verified email addresses.
Remove or rename the administrator account's email address so it cannot be trivially replayed via an external IdP.

bash

# After upgrade, verify the setting is enabled in the OIDC configuration
# require_email_verified should equal 1
sqlite3 wallos.db "SELECT require_email_verified FROM oidc_settings;"