CVE-2026-61640

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.6

Description An issue exists where administrator-configured OpenID Connect (OIDC) token url and user info url variables within the handle oidc callback.php file are used directly in the curl init() function without Server-Side Request Forgery (SSRF) filtering. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. This bypasses existing protections used for other URLs, potentially allowing an administrator to access cloud metadata or pivot into the internal network by setting the URL to an internal address such as http://169.254.169.254/latest/meta-data/.

Recommendations Update to version 4.9.6.