CVE-2026-33417 Wallos: Password Reset Tokens Never Expire
Attackers can hijack accounts using intercepted password reset tokens that never expire, affecting Wallos users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33417?
CVE-2026-33417 is a medium-severity vulnerability in ellite Wallos, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_resets table includes a created_at timestamp column, but the token validation logic never checks it. A password reset token remains valid indefinitely until it is used, allowing an attacker who intercepts a reset link at any point to use it days, weeks, or months later. This issue has been patched in version 4.7.2.
Weakness: CWE-613
Which versions are affected by CVE-2026-33417?
It affects 1 product.
Products include Wallosapp Wallos.
How do I fix CVE-2026-33417?
No fix has been published for CVE-2026-33417 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-33417 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33417 exists.
Other vulnerabilities in ellite Wallos
Sources
Also known as GHSA-p3fv-m43r-3fhf.