CVE-2026-43924
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
FOSSBilling before 0.8.0 has an open redirect vulnerability in the Redirect module. The module does not validate the URL scheme of administrator-configured destination URLs, allowing arbitrary external URLs as redirect targets.
Risk Assessment
An attacker with admin privileges can configure redirects to malicious sites, enabling phishing attacks. The redirect is persistently cached by browsers.
Recommendation
Update FOSSBilling to version 0.8.0. Restrict access to the Redirect module to trusted admins and audit existing redirect entries.
Other vulnerabilities in FOSSBilling
See all- CVE-2026-42341Critical
FOSSBilling versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability. An attacker can mark any unpaid invoice as paid and credit the client account by sending a single crafted HTTP request to the IPN callback endpoint.
- CVE-2026-33543Critical
FOSSBilling versions 0.7.2 and prior have a vulnerability in the guest API that allows the creation of new administrator accounts even when one already exists. A flaw in the admin existence check enables an attacker to bypass protections.
- CVE-2026-28496Critical
FOSSBilling prior to version 0.8.0 has a Server-Side Template Injection (SSTI) vulnerability in the template rendering system. Administrators can inject arbitrary Twig expressions, leading to information disclosure and remote code execution.
- CVE-2026-27604Critical
FOSSBilling versions 0.5.4 to 0.8.0 have an authorization bypass in API role handling, allowing unauthenticated access to privileged `/api/system/*` endpoints. Attackers can invoke admin API methods without valid credentials.
- CVE-2026-53648Medium
In FOSSBilling prior to version 0.8.1, downloadable product files are stored using a deterministic filename-derived path (MD5 hash). Two different products or order files with the same original filename overwrite each other, causing customers or administrators to receive the wrong file.
- CVE-2026-53647Medium
In FOSSBilling versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (`custom_*` fields) stored in the key's database record.
- CVE-2026-53646High
In FOSSBilling versions 0.5.6 through 0.7.2, when a client requests a password reset multiple times, the system reuses the existing token instead of generating a new one, with the 15-minute validity anchored to the first request. An attacker who obtained the original reset link can still use it even after the victim requests a new reset, as the original token is never invalidated.
- CVE-2026-53645High
FOSSBilling prior to version 0.8.0 contains a vulnerability that allows a low-privileged staff account to escalate privileges via the admin API. A user with the `staff.create_and_edit_staff` permission can call `/api/admin/staff/permissions_update` for their own account and set any permissions, bypassing role-based access control.
- CVE-2026-53644High
FOSSBilling versions 0.5.3 through 0.7.2 allow authenticated clients to read and reset API key secrets for orders that are no longer active (e.g., suspended, canceled). The root cause is missing order-state validation in two client API endpoints, despite an `isActive()` helper existing in the `Serviceapikey` module and the frontend UI correctly gating access on active orders.
- CVE-2026-53643High
FOSSBilling versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the `can_always_access` module flag and insufficient permission checks or unsafe parameter handling on individual endpoints.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Redirect module does not validate the URL scheme of administrator-configured destination URLs before storing or issuing redirects. This allows arbitrary external URLs to be configured as redirect targets, creating an open redirect vulnerability exploitable for phishing attacks. Users following a legitimate FOSSBilling URL can be silently redirected to an attacker-controlled external site. The redirect is issued as a 301 (Moved Permanently) response, which browsers cache persistently, amplifying the impact. Exploitation requires administrator privileges to create or modify redirect entries, limiting practical attack scenarios to multi-admin environments or compromised admin accounts. Version 0.8.0 fixes the issue. Some workarounds are available. Restrict admin access to the Redirect module to trusted administrators only and/or audit existing redirect entries in the database (the `extension_meta` table with `extension = 'mod_redirect'`) for any unexpected or external target URLs.