CVE-2026-53646
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In FOSSBilling versions 0.5.6 through 0.7.2, when a client requests a password reset multiple times, the system reuses the existing token instead of generating a new one, with the 15-minute validity anchored to the first request. An attacker who obtained the original reset link can still use it even after the victim requests a new reset, as the original token is never invalidated.
Risk Assessment
The risk is that an attacker who gains access to the initial password reset link can hijack the user's account, even if the victim subsequently requests multiple resets. This could lead to unauthorized access to client data and account management.
Recommendation
Upgrade FOSSBilling to version 0.8.0 immediately to fix the vulnerability. As a workaround, configure per-IP rate limiting on the password reset endpoint via a reverse proxy and manually clear expired password reset records from the database.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already exists for a client (from a previous unexpired reset request), subsequent calls to the `reset_password` guest API endpoint reuse the existing token instead of generating a new one. The 15-minute validity window is anchored to the first request's `created_at` timestamp, not the time of the most recent email. An attacker who obtained the original reset link remains able to use it even after the victim requests a new reset, because the original token is never invalidated or rotated. Version 0.8.0 patches the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password` endpoint to minimize the window of opportunity, and/or manually clear expired `client_password_reset` records from the database after a client reports a suspected compromise.