Wallos allows administrators to configure OpenID Connect token_url and user_info_url directly. Prior to version 4.9.6 these URLs are evaluated by the application without any Server‑Side Request Forgery filtering, making the server follow the supplied addresses. An attacker who can set a malicious OIDC endpoint or compromise a privileged administrator can cause the server to fetch arbitrary internal resources—including cloud metadata endpoints such as http://169.254.169.254—resulting in leakage of sensitive configuration or host information and potentially enabling deeper network pivoting.

All installations of ellite:Wallos running any version earlier than 4.9.6 are affected. The weakness resides in the administrator‑controlled configuration located in includes/oidc/handle_oidc_callback.php, where token_url and user_info_url are set and later passed to curl_init().

The vulnerability scores a CVSS of 8.5, indicating high overall risk. The attack vector requires the attacker to manipulate the OIDC URL configuration, which can be achieved through privileged administrative access or by compromising an administrator account. The risk is elevated due to the potential to read internal network resources or cloud instance metadata, although the vulnerability is not currently listed in the CISA KEV catalog.