Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.

Wallos, an open-source self-hostable subscription tracker, contains a critical authentication vulnerability in versions 4.0.0 through 4.9.5. The OIDC login flow matches incoming identities to local accounts solely based on the email claim, without checking the email_verified flag from the Identity Provider. An attacker can exploit this by authenticating via an IdP that allows arbitrary or unverified email addresses, such as multi-tenant or open self-registration IdPs. By presenting an admin's email address during OIDC login, an attacker with no existing Wallos account can gain full administrative access without knowing any password. This constitutes a complete account takeover vulnerability. The flaw is especially dangerous when Wallos is configured against permissive or attacker-controlled IdPs. The vulnerability has been patched in version 4.9.6, and users are strongly advised to upgrade immediately.