The vulnerability allows an attacker who obtains a password reset token to reuse it indefinitely. The token never expires, so an intercepted link can be used regardless of the elapsed time. This gives the attacker permanent access to the targeted account, enabling full account takeover.

The only affected software is the ellite:Wallos personal subscription tracker, before version 4.7.2. Vendors recommend upgrading to version 4.7.2 or newer to remove the flaw.

With a CVSS score of 6.5, the flaw carries moderate severity. The EPSS score indicates a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Attackers would typically need to intercept the reset link—e.g., by compromising email or an insecure network connection—to use it, after which the token remains valid and can be reused at any time.