CVE-2026-61640 Wallos: SSRF via OIDC Token/UserInfo URL Configuration
Admins can configure malicious OIDC URLs to trigger Server-Side Request Forgery, allowing access to internal networks or cloud metadata.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61640?
CVE-2026-61640 is a high-severity server-side request forgery vulnerability in ellite Wallos, published on 31 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.
Weakness: CWE-918
Which versions are affected by CVE-2026-61640?
How do I fix CVE-2026-61640?
No fix has been published for CVE-2026-61640 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-61640 being exploited?
There is no known exploitation of CVE-2026-61640 in the wild and no public exploit code.
Sources
Also known as GHSA-x9x5-gh69-q7cm.