CVE-2026-54599 in Wallos
Summary
by MITRE • 08/31/2026
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account. This issue has been patched in version 4.9.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in Wallos prior to version 4.9.4 represents a critical failure in the implementation of OpenID Connect authentication protocols, specifically concerning state parameter validation during the authorization code flow. In standard OIDC implementations, the state parameter serves as a crucial security mechanism designed to prevent Cross-Site Request Forgery attacks and ensure that the authentication response corresponds to an initial request initiated by the user's browser. The application correctly generates this nonce value upon initiating login and stores it within the server-side session variable $_SESSION['oidc_state']. However, the subsequent callback handler located in checksession.php fails to perform any verification logic to compare the state parameter received from the OpenID Connect provider against the stored session value. This omission effectively nullifies one of the primary defenses against authentication bypass attacks inherent in OAuth and OIDC flows.
From a technical perspective, this flaw allows an attacker to exploit the lack of state validation by crafting a malicious URL that initiates an authorization request with a pre-determined or known state parameter. When a victim interacts with this crafted link, their browser is redirected to the identity provider for authentication. Upon successful login at the provider's end, the redirect back to Wallos includes the attacker-controlled state value in the query parameters. Because checksession.php does not validate that this incoming state matches the session-stated nonce generated during the initial request phase, the application accepts the authorization code associated with the attacker's account. Consequently, the server exchanges this code for tokens and establishes a new authenticated session for the victim user, effectively logging them into the attacker's Wallos account without any knowledge or consent from the legitimate user.
The operational impact of this vulnerability is severe, as it constitutes an authentication bypass that can lead to unauthorized access to personal subscription data. Since Wallos tracks sensitive financial information such as recurring payments and service subscriptions, compromising a victim's session could expose detailed spending habits, bank account associations, and other personally identifiable information. Furthermore, if the application supports administrative functions or integrates with external services using stored credentials, an attacker gaining control of the user session might escalate privileges to perform actions on behalf of the victim, such as modifying subscription details or exporting data. This type of attack is particularly insidious because it relies on social engineering tactics where the victim must actively click a link, making detection by automated security monitoring tools difficult without specific behavioral analysis.
This vulnerability aligns with CWE-345, which describes Insufficient Verification of Data Authenticity, and more specifically relates to improper validation of state parameters in OAuth flows. In terms of offensive cybersecurity frameworks, this exploit maps directly to the MITRE ATT&CK technique T1078, Valid Accounts, where an adversary gains legitimate access by exploiting authentication flaws rather than breaking encryption or stealing credentials through brute force methods. The failure to verify the state parameter is a classic implementation error that undermines the integrity guarantees provided by OIDC.
To mitigate this vulnerability and prevent similar issues in future development cycles, it is imperative to implement strict validation of the state parameter during every callback request. Developers must ensure that the state value received from the identity provider matches exactly with the one stored in the user's session at the time the login was initiated. Additionally, best practices dictate that once a successful authentication and token exchange are completed, the session-stored state nonce should be immediately invalidated or removed to prevent replay attacks where an intercepted callback might attempt to reuse old tokens. Upgrading to version 4.9.4 of Wallos resolves this issue by correcting the logic within checksession.php to properly compare incoming states against stored values, thereby restoring the integrity of the authentication flow and protecting user data from unauthorized access via crafted URLs.