CVE-2026-108108
HighCVSS 7.1Summary
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.
Risk Assessment
An attacker can gain unauthorized network access by impersonating a customer and consume their plan. This leads to network security breaches and financial losses.
Recommendation
Update PHPNuxBill to a version later than 2025.3.20. Verify the correctness of the CHAP verification implementation and monitor for unauthorized login attempts.
Other vulnerabilities in PHPNuxBill
See all- CVE-2026-108109Critical
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php. An unauthenticated attacker can brute-force the 6-digit otp_code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
- CVE-2026-108107Critical
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
Original NVD description (English source)
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS