CVE-2026-61641

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61641", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-10T17:38:57.111Z", "datePublished": "2026-08-31T20:49:46.759Z", "dateUpdated": "2026-09-01T14:58:03.788Z"}, "containers": {"cna": {"title": "Wallos: OIDC account takeover via email-based account linking without `email_verified` check", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ellite/Wallos/security/advisories/GHSA-qwgp-m2f3-6j3r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ellite/Wallos/security/advisories/GHSA-qwgp-m2f3-6j3r"}, {"name": "https://github.com/ellite/Wallos/pull/1092", "tags": ["x_refsource_MISC"], "url": "https://github.com/ellite/Wallos/pull/1092"}, {"name": "https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3", "tags": ["x_refsource_MISC"], "url": "https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3"}, {"name": "https://github.com/ellite/Wallos/releases/tag/v4.9.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/ellite/Wallos/releases/tag/v4.9.6"}], "affected": [{"vendor": "ellite", "product": "Wallos", "versions": [{"version": ">= 4.0.0, < 4.9.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-31T20:49:46.759Z"}, "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin \u2014 full account takeover, no password needed. This issue has been patched in version 4.9.6."}], "source": {"advisory": "GHSA-qwgp-m2f3-6j3r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-01T14:16:59.947469Z", "id": "CVE-2026-61641", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T14:58:03.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-61641", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-01T14:16:59.947469Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T14:17:01.231Z"}}], "cna": {"title": "Wallos: OIDC account takeover via email-based account linking without `email_verified` check", "source": {"advisory": "GHSA-qwgp-m2f3-6j3r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ellite", "product": "Wallos", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.9.6"}]}], "references": [{"url": "https://github.com/ellite/Wallos/security/advisories/GHSA-qwgp-m2f3-6j3r", "name": "https://github.com/ellite/Wallos/security/advisories/GHSA-qwgp-m2f3-6j3r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ellite/Wallos/pull/1092", "name": "https://github.com/ellite/Wallos/pull/1092", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3", "name": "https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ellite/Wallos/releases/tag/v4.9.6", "name": "https://github.com/ellite/Wallos/releases/tag/v4.9.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin \u2014 full account takeover, no password needed. This issue has been patched in version 4.9.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-31T20:49:46.759Z"}}}, "cveMetadata": {"cveId": "CVE-2026-61641", "state": "PUBLISHED", "dateUpdated": "2026-09-01T14:58:03.788Z", "dateReserved": "2026-07-10T17:38:57.111Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-31T20:49:46.759Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Wallos", "vendor": "ellite", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.9.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin \u2014 full account takeover, no password needed. This issue has been patched in version 4.9.6."}], "id": "CVE-2026-61641", "lastModified": "2026-09-08T21:11:31.703", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61641", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-01T14:16:59.947469Z", "version": "2.0.3"}}]}, "published": "2026-08-31T21:17:17.373", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ellite/Wallos/commit/b75f13d0ffa3ed7e77e8e79e4b9fd3fc528c98d3"}, {"source": "security-advisories@github.com", "url": "https://github.com/ellite/Wallos/pull/1092"}, {"source": "security-advisories@github.com", "url": "https://github.com/ellite/Wallos/releases/tag/v4.9.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/ellite/Wallos/security/advisories/GHSA-qwgp-m2f3-6j3r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.9.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Wallos", "source": "cna", "vendor": "ellite"}, "product": "wallos", "vendor": "ellite"}], "created": "2026-08-31T22:30:06.007217+00:00", "updated": "2026-08-31T23:15:04.761680+00:00", "vendors": ["ellite", "ellite$PRODUCT$wallos"]}