CVE-2026-61641

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61641
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61641.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61641
Aliases
  • GHSA-qwgp-m2f3-6j3r
Published
2026-08-31T20:49:46.759Z
Modified
2026-09-02T03:47:25.541372964Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Wallos: OIDC account takeover via email-based account linking without `email_verified` check
Details

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61641.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-287"
    ]
}
References

Affected packages

Git / github.com/ellite/wallos

Affected ranges

Type
GIT
Repo
https://github.com/ellite/wallos
Events
Introduced
bff79a1940a8c988fa7c7880c9c43ed40bce34ea
Fixed
02826761b0e7b94d40f23f1511dcfcd563aa6ee6
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.9.6"
        }
    ]
}

Affected versions

v4.*
v4.0.0
v4.1.0
v4.1.1
v4.2.0
v4.3.0
v4.4.0
v4.4.1
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.8.0
v4.8.1
v4.8.2
v4.8.3
v4.8.4
v4.9.0
v4.9.1
v4.9.2
v4.9.3
v4.9.4
v4.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61641.json"