EUVD-2026-34255Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint /client/reset-password-confirm/:hash is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to /api/* routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). An attacker can submit unlimited token guesses to the password reset confirmation endpoint with no throttling applied. However, practical exploitability is significantly mitigated by the current token generation, which uses hash('sha256', random_bytes(32)), providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including /staff/email/:hash (admin password reset confirmation) and /client/confirm-email/:hash (email confirmation). Version 0.8.0 fixes the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the /client/reset-password-confirm/* and /staff/email/* paths and/or use a WAF rule to limit request rates to these endpoints.
AnalysisAI
Password reset token enumeration in FOSSBilling prior to 0.8.0 exposes three authentication endpoints - including the elevated-privilege admin reset at /staff/email/:hash - to unlimited brute-force guessing due to a rate limiter architecturally scoped exclusively to /api/* routes. The confirmation endpoint acts as a CWE-204 oracle, returning distinguishable HTTP responses (200 for valid tokens, 302 redirect for invalid), allowing an unauthenticated remote attacker to probe token validity without throttling, lockout, or attempt counting. Practical exploitation risk is substantially reduced by 256-bit token entropy (hash('sha256', random_bytes(32))) combined with a 15-minute expiry window, which is accurately reflected in the CVSS 4.0 AC:H/AT:P scoring; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The root cause is a CWE-204 (Observable Response Discrepancy) implementation gap: FOSSBilling's rate-limiting middleware is bound exclusively to /api/* route prefixes, leaving controller-served routes entirely unthrottled. Three endpoints are affected: /client/reset-password-confirm/:hash (client password reset confirmation), /staff/email/:hash (admin/staff password reset confirmation), and /client/confirm-email/:hash (email address confirmation). Each endpoint returns a semantically distinct HTTP status code - HTTP 200 for a valid, unexpired token versus HTTP 302 redirect for an invalid one - creating a side-channel oracle that enables token validity probing with no server-side cost to the attacker. Token generation in affected versions uses PHP's hash('sha256', random_bytes(32)), which produces 256 bits of effective entropy from a cryptographically secure pseudorandom source, making brute force computationally infeasible in practice. CPE cpe:2.3:a:fossbilling:fossbilling:*:*:*:*:*:*:*:* confirms all FOSSBilling releases preceding 0.8.0 carry this architectural flaw. The fix in version 0.8.0 (PR #3461) extends rate limit coverage to include controller-served authentication routes.
RemediationAI
The primary fix is upgrading to FOSSBilling 0.8.0 (released 2026-05-28), which extends the rate limit system to cover controller-served authentication routes (PR #3461) alongside broader security hardening; the release is available at https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0. Important: version 0.8.0 introduces breaking changes including a mandatory PHP 8.3 minimum requirement - verify your server environment and review the full release notes before upgrading, and back up your installation first. For installations that cannot immediately upgrade, configure a reverse proxy (Nginx or Apache) or CDN/WAF (e.g., Cloudflare) to enforce per-IP rate limiting on the paths /client/reset-password-confirm/*, /staff/email/*, and /client/confirm-email/*; a limit of 10 requests per IP per 15-minute window would effectively eliminate the oracle threat without impacting legitimate users who rarely interact with these endpoints. Note that aggressive rate limiting on /client/confirm-email/* may delay legitimate email confirmation for users behind shared egress IPs (e.g., corporate NAT or VPN), so apply a more permissive threshold to that path if needed. Prioritize the /staff/email/* workaround if the full upgrade cannot be performed immediately, as that path protects admin-level credentials.
More in Fossbilling
View allSQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated critical severity (CVSS 9.8), this vuln
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated high
Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated high severity (CVSS 7.5), this
Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated high severity (CVSS 7.2), this vulnera
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 6.5), thi
Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. Rated medium severit
Authorization bypass in FOSSBilling versions 0.5.4 through 0.7.x allows unauthenticated remote attackers to invoke privi
Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. Rated critical severity (CV
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 5.7), thi
Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium sev
Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated medium severity (CVSS 5.4), this vul
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today