EUVD-2026-41944Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed /ipn.php endpoint
-
DeliveryCraft forged Custom-adapter IPN callback
-
ExploitSend single unauthenticated HTTP request
-
ExecutionInvoice marked paid and account credited
-
ImpactObtain paid services or store credit
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The exploit requires that the FOSSBilling 'Custom' payment adapter/gateway be enabled and that the IPN endpoint /ipn.php be network-reachable by the attacker - that specific configuration IS the precondition. Given the enabled Custom adapter, no authentication, credentials, or user interaction are needed (PR:N/UI:N/AC:L): a single crafted HTTP request suffices. The limiting factors that reduce real-world exposure are that the Custom payment adapter is a non-default integration many deployments will not have enabled, and that IP-level restrictions on /ipn.php (if configured) would block untrusted callers. |
| Impact | The signals are largely consistent and point to a genuine, high-severity integrity issue rather than an inflated score. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reach, low complexity, no privileges, and no user interaction, with impact concentrated on integrity (VI:H and SI:H) and no confidentiality or availability effect - matching a payment-bypass that forges financial state but does not read data or crash the service. The one real gating factor, honestly reflected in the description, is that the Custom payment adapter must be enabled, which is a non-default deployment condition and the main thing that keeps this from being universally exploitable. EPSS was not provided, so exploitation-probability cannot be quantified. It is not in CISA KEV and no POC is referenced, so this should be treated as a serious pre-exploitation priority (direct financial fraud with a one-shot request) rather than confirmed active exploitation. Net: high priority for any FOSSBilling operator using the Custom gateway; low urgency for those who do not have that adapter enabled. |
| Exploit ScenarioDerived | On a FOSSBilling instance with the Custom payment adapter enabled, an attacker registers or targets an account with outstanding invoices, then sends one crafted unauthenticated HTTP POST to /ipn.php referencing the target invoice. FOSSBilling accepts the forged callback, marks the invoice paid, and credits the client account, granting paid services or store credit without any real payment. No POC is publicly referenced, but the low attack complexity (AC:L, PR:N, UI:N) makes reliable exploitation straightforward once the endpoint and parameters are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Unauthenticated payment bypass in FOSSBilling 0.6.0 through 0.7.2 lets a remote attacker mark any unpaid invoice as paid and credit the associated client's account balance with a single crafted HTTP request to the IPN callback endpoint (/ipn.php), provided the Custom payment adapter is enabled. The flaw stems from missing authentication (CWE-306) on a financially critical callback, so no credentials or user interaction are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it 9.2 (CVSS 4.0) and a patched release (0.8.0) is available.
RemediationAI
Vendor-released patch: upgrade to FOSSBilling 0.8.0, which fixes the IPN authentication gap; this is the primary and recommended action per advisory GHSA-5493-9m76-2qrr (https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-5493-9m76-2qrr). If you cannot upgrade immediately, disable the Custom payment gateway when it is not actively needed, which removes the vulnerable code path entirely but also disables that payment method. Alternatively, restrict access to /ipn.php at the web server level via IP allowlisting limited to your payment provider's callback source addresses; note the trade-off the vendor calls out - overly broad or misconfigured allowlisting can interfere with legitimate payment callback processing and silently drop valid IPNs, so validate against your provider's documented callback IP ranges before relying on it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FOSSBilling is a PHP-based open-source billing and client-management platform. The affected component is its Instant Payment Notification (IPN) handler exposed at /ipn.php, which payment gateways call server-to-server to confirm that a transaction has settled. The 'Custom' payment adapter is a generic gateway integration; when enabled, its IPN branch accepts and acts on callback data without verifying the caller's authenticity or the payment's legitimacy. This is a textbook CWE-306 (Missing Authentication for Critical Function): a state-changing, money-relevant operation (marking invoices paid, adding account credit) is reachable by anyone who can send an HTTP request. The single affected CPE is cpe:2.3:a:fossbilling:fossbilling, versions 0.6.0-0.7.2.
Know when Fossbilling gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Remote, low-complexity, unauthenticated single request (AV:N/AC:L/PR:N/UI:N) forging financial state gives I:H with no confidentiality or availability impact; enabling the adapter is config, not a privilege.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to /ipn.php at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.
Articles & Coverage 2
Executive ViewAI
FOSSBilling versions 0.6.0-0.7.2 contain a critical vulnerability allowing unauthenticated attackers to mark unpaid invoices as paid and credit customer accounts, creating direct revenue leakage and fraud risk. No public exploit has been identified, but the vulnerability requires only network access with no authentication. A patched release (0.8.0) is available and should be deployed immediately to all affected instances.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Fossbilling
View allAuthorization bypass in FOSSBilling versions 0.5.4 through 0.7.x allows unauthenticated remote attackers to invoke privi
SQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated critical severity (CVSS 9.8), this vuln
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated high
Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated high severity (CVSS 7.5), this
Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated high severity (CVSS 7.2), this vulnera
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 6.5), thi
Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. Rated medium severit
Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. Rated critical severity (CV
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 5.7), thi
Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium sev
Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated medium severity (CVSS 5.4), this vul
Exploit-DB