A critical authentication bypass flaw in Wallos allows unauthenticated attackers to log victims into malicious accounts, posing a significant risk to user data privacy.

The application fails to validate the OIDC state nonce during the callback process in checksession.php, which permits a cross-site request forgery style attack. This allows an unauthenticated attacker to trick a user into completing an authentication flow that links the victim session to an attacker-controlled account.

Successful exploitation of this vulnerability leads to account takeover scenarios where users are unknowingly authenticated into attacker-controlled accounts. Given the CVSS score of 7.5, this high-severity flaw threatens the confidentiality and integrity of user subscription data, potentially leading to unauthorized access and severe reputational damage to the self-hosted instance.

Immediate Action: Update the Wallos installation to version 4.9.4 or later immediately to implement the required OIDC state validation logic.

Proactive Monitoring: Review web access logs for unusual OIDC callback traffic or unexpected account activity patterns that deviate from established user behavior.

Compensating Controls: Ensure that users are educated on the risks of clicking suspicious links while authenticated to sensitive internal applications, and consider implementing strict browser-level security policies.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant security risk to the authentication integrity of Wallos instances. IT administrators should prioritize the upgrade to version 4.9.4 to ensure that OIDC callbacks are correctly validated, thereby preventing unauthorized account linking and protecting user accounts from compromise.