CVE-2026-33417

HIGH EPSS 17.7%
Published Mar 24, 20263mo ago · Modified Jun 17, 20262w ago
7.1 CVSS 3.1
High
Find Similar
Published Mar 24, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_resets table includes a created_at timestamp column, but the token validation logic never checks it. A password reset token remains valid indefinitely until it is used, allowing an attacker who intercepts a reset link at any point to use it days, weeks, or months later. This issue has been patched in version 4.7.2.

CVSS Details

Base Score
7.1
Exploitability
2.8
Impact
4.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
17.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-613

Affected Products 1

VendorProductVersionRange
wallosappwallos* <4.7.2

References 2

  • github.com https://github.com/ellite/Wallos/commit/90bb6186ee4091590b6efdef824c85f2494ff2bb
    Patch
  • github.com https://github.com/ellite/Wallos/security/advisories/GHSA-p3fv-m43r-3fhf
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/ellite/Wallos/commit/90bb6186ee4091590b6efdef824c85f2494ff2bb
    Patch