CVE-2026-33417

Katalog CVE

CVSS 7.1 · High EPSS 0,31%

Kerentanan Insufficient Session Expiration pada wallosapp wallos. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_resets table includes a created_at timestamp column, but the token validation logic never checks it. A password reset token remains valid indefinitely until it is used, allowing an attacker who intercepts a reset link at any point to use it days, weeks, or months later. This issue has been patched in version 4.7.2.

Rincian

Terbit di NVD

24 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ellite/Wallos/security/advisories/GHSA-p3fv-m43r-3fhf exploit · advisory vendor
• https://github.com/ellite/Wallos/commit/90bb6186ee4091590b6efdef824c85f2494ff2bb patch