CVE-2026-61640

Wallos , an open-source self-hostable personal subscription tracker, is affected by an SSRF vulnerability prior to version 4.9.6. The root cause is in includes/oidc/handle_oidc_callback.php (lines 18–49), where Admin-configured OIDC token_url and user_info_url values are passed directly to curl_i...

CVE-2026-61640

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC tokenurl and userinfourl in includes/oidc/handleoidccallback.php:18-49 are used directly in curlinit with zero SSRF filtering. Unlike logo/webhook URLs which have...