CVE-2026-33417

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The passwordresets table includes a createdat timestamp column, but the token validation logic never checks it. A password reset token remains valid...

CVE-2026-33417

Wallos before version 4.7.2: password reset tokens never expire because the token validation logic does not check the created_at timestamp in the password_resets table. Tokens remain valid indefinitely until used, allowing reuse if a reset link is intercepted at any time. Remediation: upgrade to ...