A critical authentication vulnerability in Wallos allows unauthenticated attackers to perform full account takeovers by exploiting improper OIDC email verification.

The application fails to verify the email_verified claim during the OpenID Connect (OIDC) login process. This allows an unauthenticated attacker to associate an arbitrary email address with their session, effectively bypassing authentication and gaining unauthorized access to any user account, including administrative accounts.

The exploitation of this flaw grants an attacker full administrative control over the Wallos instance. Given the CVSS score of 8.1, the high severity reflects the potential for complete data compromise, unauthorized access to sensitive financial subscription tracking information, and full system takeover without requiring prior authentication.

Immediate Action: Update the Wallos instance to version 4.9.6 or later immediately to enforce proper OIDC email verification.

Proactive Monitoring: Review authentication and access logs for suspicious logins, particularly those originating from unexpected OIDC providers or anomalous patterns involving administrative accounts.

Compensating Controls: If immediate patching is not possible, consider disabling OIDC authentication and reverting to local credential-based authentication until the update can be applied.

Public Exploit Available: No

The severity of this vulnerability necessitates an immediate response, as it permits unauthenticated account takeover of the application. Administrators must prioritize upgrading to version 4.9.6 to remediate the logic flaw in the authentication service. Failure to patch leaves the system vulnerable to unauthorized access and potential data exfiltration.