CVE-2026-43926
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
FOSSBilling prior to version 0.8.0 does not apply rate limiting to the password reset confirmation endpoint `/client/reset-password-confirm/:hash` because the rate limiter only applies to `/api/*` routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). However, practical exploitability is significantly mitigated by the current token generation, which uses `hash('sha256', random_bytes(32))`, providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including `/staff/email/:hash` and `/client/confirm-email/:hash`. Version 0.8.0 fixes the issue.
Risk Assessment
An attacker could potentially guess a password reset token and take over a user account, although this requires a large number of attempts due to high token entropy.
Recommendation
It is recommended to immediately update FOSSBilling to version 0.8.0 or later. As a temporary workaround, configure rate limiting at the reverse proxy level (e.g., Nginx, Apache, Cloudflare) for the `/client/reset-password-confirm/*` and `/staff/email/*` paths.
Other vulnerabilities in FOSSBilling
See all- CVE-2026-42341Critical
FOSSBilling versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability. An attacker can mark any unpaid invoice as paid and credit the client account by sending a single crafted HTTP request to the IPN callback endpoint.
- CVE-2026-33543Critical
FOSSBilling versions 0.7.2 and prior have a vulnerability in the guest API that allows the creation of new administrator accounts even when one already exists. A flaw in the admin existence check enables an attacker to bypass protections.
- CVE-2026-28496Critical
FOSSBilling prior to version 0.8.0 has a Server-Side Template Injection (SSTI) vulnerability in the template rendering system. Administrators can inject arbitrary Twig expressions, leading to information disclosure and remote code execution.
- CVE-2026-27604Critical
FOSSBilling versions 0.5.4 to 0.8.0 have an authorization bypass in API role handling, allowing unauthenticated access to privileged `/api/system/*` endpoints. Attackers can invoke admin API methods without valid credentials.
- CVE-2026-53648Medium
In FOSSBilling prior to version 0.8.1, downloadable product files are stored using a deterministic filename-derived path (MD5 hash). Two different products or order files with the same original filename overwrite each other, causing customers or administrators to receive the wrong file.
- CVE-2026-53647Medium
In FOSSBilling versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (`custom_*` fields) stored in the key's database record.
- CVE-2026-53646High
In FOSSBilling versions 0.5.6 through 0.7.2, when a client requests a password reset multiple times, the system reuses the existing token instead of generating a new one, with the 15-minute validity anchored to the first request. An attacker who obtained the original reset link can still use it even after the victim requests a new reset, as the original token is never invalidated.
- CVE-2026-53645High
FOSSBilling prior to version 0.8.0 contains a vulnerability that allows a low-privileged staff account to escalate privileges via the admin API. A user with the `staff.create_and_edit_staff` permission can call `/api/admin/staff/permissions_update` for their own account and set any permissions, bypassing role-based access control.
- CVE-2026-53644High
FOSSBilling versions 0.5.3 through 0.7.2 allow authenticated clients to read and reset API key secrets for orders that are no longer active (e.g., suspended, canceled). The root cause is missing order-state validation in two client API endpoints, despite an `isActive()` helper existing in the `Serviceapikey` module and the frontend UI correctly gating access on active orders.
- CVE-2026-53643High
FOSSBilling versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the `can_always_access` module flag and insufficient permission checks or unsafe parameter handling on individual endpoints.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to `/api/*` routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). An attacker can submit unlimited token guesses to the password reset confirmation endpoint with no throttling applied. However, practical exploitability is significantly mitigated by the current token generation, which uses `hash('sha256', random_bytes(32))`, providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including `/staff/email/:hash` (admin password reset confirmation) and `/client/confirm-email/:hash` (email confirmation). Version 0.8.0 fixes the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password-confirm/*` and `/staff/email/*` paths and/or use a WAF rule to limit request rates to these endpoints.