CVE-2026-61641: CWE-287: Improper Authentication in ellite Wallos

CVE-2026-61641 describes an improper authentication vulnerability (CWE-287) in Wallos versions >=4.0.0 <4.9.6. The flaw arises because Wallos's OIDC login mechanism links identities solely based on the email claim, ignoring the 'email_verified' attribute from the identity provider (IdP). When Wallos is configured with an IdP that allows unverified or arbitrary emails (such as multi-tenant IdPs or those with open self-registration), an attacker without a Wallos account can authenticate as another user, including administrators, by presenting the admin's email. This results in full account takeover without requiring a password. The vulnerability has a CVSS 3.1 score of 8.1 (high severity) and was patched in Wallos version 4.9.6.

An attacker can gain unauthorized full access to any Wallos account, including administrator accounts, by exploiting the improper authentication mechanism. This leads to complete account takeover without needing valid credentials or passwords, compromising confidentiality, integrity, and availability of the affected accounts.

Upgrade Wallos to version 4.9.6 or later, where this vulnerability is patched. The fix ensures that the 'email_verified' claim from the IdP is properly checked before linking an OIDC identity to a local account. Until upgrading, avoid using IdPs that allow unverified or arbitrary emails or restrict OIDC login to trusted IdPs that enforce email verification.