https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:14:00 +0000 https://vulnerability.circl.lu/vuln/cve-2026-61641 <p><strong>Affected:</strong> ellite Wallos</p> <p>Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos&#39;s OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin&#39;s email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.</p> <p><strong>Affected:</strong> ellite Wallos</p> <p>Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos&#39;s OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin&#39;s email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.</p> https://vulnerability.circl.lu/vuln/cve-2026-61641