---
id: CVE-2026-61641
title: 'Wallos is an open-source, self-hostable personal subscription tracker'
summary: >-
  Wallos is an open-source, self-hostable personal subscription tracker. From
  version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming
  OIDC identity to an existing local account by matching the email claim alone,
  withou…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-287
published: '2026-08-31'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:11:31.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61641'
references:
  - url: >-
      https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/pull/1092'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/releases/tag/v4.9.6'
    label: security-advisories@github.com
  - url: 'https://github.com/ellite/Wallos/security/advisories/GHSA-qwgp-m2f3-6j3r'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00307
epssPercentile: 0.23652
ingestedAt: '2026-09-08T22:12:30.944Z'
---

## Overview

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.