| Package | Affected versions | Patched versions |
|---|---|---|
| wallos | < 4.7.2 | 4.7.2 |
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The password_resets table includes a created_at timestamp column, but the token validation logic never checks it. A password reset token remains valid indefinitely until it is used, allowing an attacker who intercepts a reset link at any point to use it days, weeks, or months later. This issue has been patched in version 4.7.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free