EUVD-2026-41944Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated single request (AV:N/AC:L/PR:N/UI:N) forging financial state gives I:H with no confidentiality or availability impact; enabling the adapter is config, not a privilege.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to /ipn.php at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.
Articles & Coverage 2
AnalysisAI
Unauthenticated payment bypass in FOSSBilling 0.6.0 through 0.7.2 lets a remote attacker mark any unpaid invoice as paid and credit the associated client's account balance with a single crafted HTTP request to the IPN callback endpoint (/ipn.php), provided the Custom payment adapter is enabled. The flaw stems from missing authentication (CWE-306) on a financially critical callback, so no credentials or user interaction are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it 9.2 (CVSS 4.0) and a patched release (0.8.0) is available.
Technical ContextAI
FOSSBilling is a PHP-based open-source billing and client-management platform. The affected component is its Instant Payment Notification (IPN) handler exposed at /ipn.php, which payment gateways call server-to-server to confirm that a transaction has settled. The 'Custom' payment adapter is a generic gateway integration; when enabled, its IPN branch accepts and acts on callback data without verifying the caller's authenticity or the payment's legitimacy. This is a textbook CWE-306 (Missing Authentication for Critical Function): a state-changing, money-relevant operation (marking invoices paid, adding account credit) is reachable by anyone who can send an HTTP request. The single affected CPE is cpe:2.3:a:fossbilling:fossbilling, versions 0.6.0-0.7.2.
RemediationAI
Vendor-released patch: upgrade to FOSSBilling 0.8.0, which fixes the IPN authentication gap; this is the primary and recommended action per advisory GHSA-5493-9m76-2qrr (https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-5493-9m76-2qrr). If you cannot upgrade immediately, disable the Custom payment gateway when it is not actively needed, which removes the vulnerable code path entirely but also disables that payment method. Alternatively, restrict access to /ipn.php at the web server level via IP allowlisting limited to your payment provider's callback source addresses; note the trade-off the vendor calls out - overly broad or misconfigured allowlisting can interfere with legitimate payment callback processing and silently drop valid IPNs, so validate against your provider's documented callback IP ranges before relying on it.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today