CVE-2026-108109
CriticalCVSS 9.1Summary
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php. An unauthenticated attacker can brute-force the 6-digit otp_code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
Risk Assessment
An attacker knowing a customer username can take over that account, gaining access to data and functions available to that account.
Recommendation
Update PHPNuxBill to a version later than 2025.3.20. Implement attempt limits and account lockout for the password reset flow and do not return the password in the HTTP response.
Other vulnerabilities in PHPNuxBill
See all- CVE-2026-108108High
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.
- CVE-2026-108107Critical
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
Original NVD description (English source)
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS