PHPNuxBill CVE-2026-108108

Exploitation requires that PHPNuxBill be deployed as the RADIUS backend for MikroTik hotspot or PPPoE using CHAP authentication; the attacker must (1) have adjacent-network access sufficient to initiate a hotspot/PPPoE CHAP session and (2) already know a valid customer or PPPoE username. Limiting factors: the Adjacent (not internet-wide) attack vector, the requirement to know a valid username, and the dependence on CHAP being the authentication method in use (PAP-only deployments are not implicated by the described chap_verify() flaw). No special privileges, credentials, or user interaction are otherwise needed, and default behavior is affected for installations in versions through 2025.3.20.

CVSS 4.0 base score is 7.1 (High), driven by low attack complexity and no privileges/user interaction required, but tempered by an Adjacent attack vector (AV:A) - the attacker must be able to initiate a MikroTik hotspot or PPPoE CHAP session, i.e. be on the ISP's access network, not the open internet. No EPSS score, CISA KEV listing, or public exploit code is present in the provided data, so there is no evidence of active or at-scale exploitation; this is currently a disclosed logic flaw (reported by VulnCheck, with a vendor GitHub Security Advisory) rather than a KEV-grade emergency. No SSVC decision data was supplied. The flaw itself is trivially reliable once an attacker is positioned - any incorrect CHAP response authenticates - but exploitation is gated by two real prerequisites: adjacent-network access and knowledge of a valid customer/PPPoE username. Net assessment: a credible, moderate-priority issue for organizations actually running PHPNuxBill with CHAP, not a widespread internet-facing crisis; the primary impact is service/resource abuse (consuming a victim's plan) rather than full system compromise. Note the VI:H rating in the supplied vector is somewhat generous for what is effectively account impersonation/resource theft - verify impact scoping against your deployment.

An attacker within range of an ISP or venue using PHPNuxBill-backed MikroTik hotspot/PPPoE authentication learns a legitimate customer's username (often guessable, printed on vouchers, or observable). They initiate a CHAP login supplying that username with any arbitrary password; because Password::chap_verify() returns true on a non-matching response, authentication succeeds and the attacker obtains network access billed against the victim's plan. No public exploit code was identified at time of analysis, but the flaw is a one-line logic error that is trivial to weaponize.