EUVD-2026-41964Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint requires authenticated client access (PR:L); no scope change, confidentiality, or availability impact; only invoice payment integrity (I:L) is affected.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the PayPalEmail payment adapter accepts PayPal IPN callbacks and credits the IPN-supplied amount (mc_gross) to the client's balance without validating it against the invoice total. Combined with a $0.05 floating-point epsilon tolerance in the invoice credit-payment logic, this allows a client to underpay an invoice by up to $0.04 and still have it marked as fully paid. Version 0.8.0 patches the issue. There is no effective workaround without modifying the source code. Merchants using the PayPalEmail adapter should monitor IPN transactions for amounts that do not match their corresponding invoice totals, and manually review and refund suspicious payments.
AnalysisAI
FOSSBilling's PayPalEmail payment adapter prior to version 0.8.0 fails to validate IPN-supplied payment amounts against invoice totals, enabling authenticated clients to underpay invoices while having them marked as fully paid. The PayPal IPN field mc_gross is credited directly to the client balance without cross-checking the corresponding invoice amount, and a pre-existing $0.05 floating-point epsilon in the credit-payment logic expands the exploitable gap to $0.04 per invoice. No public exploit code exists and the vulnerability is not in CISA KEV; however, the attack is trivially executable by any registered client on a system with the PayPalEmail adapter enabled.
Technical ContextAI
FOSSBilling is an open-source PHP-based billing and client management platform. The PayPalEmail adapter integrates PayPal's Instant Payment Notification (IPN) mechanism, which delivers asynchronous POST callbacks containing payment metadata fields such as mc_gross (gross payment amount). The vulnerability stems from the adapter crediting the IPN-supplied mc_gross value directly to the client account without comparing it to the corresponding invoice total - a classic CWE-754 (Improper Check for Unusual or Exceptional Conditions) pattern where an application omits a mandatory validation before acting on externally supplied data. Separately, the core invoice credit-payment logic uses a $0.05 floating-point epsilon tolerance to accommodate minor rounding differences; combined with the missing IPN validation, this tolerance becomes an exploitable window, allowing any underpayment below $0.05 - practically $0.04 - to pass as full settlement. No CPE string was included in the source data; affected scope is any FOSSBilling instance prior to 0.8.0 that has the PayPalEmail adapter configured.
RemediationAI
Vendor-released patch: FOSSBilling 0.8.0. Operators should upgrade to version 0.8.0 immediately, as the vendor states there is no effective workaround without modifying the source code. For deployments that cannot be upgraded promptly, the vendor recommends monitoring all PayPal IPN transactions by manually comparing the IPN mc_gross field against the corresponding invoice total and manually reviewing or reversing any payments where the amounts diverge. This manual approach carries significant operational overhead, introduces human error risk, and is not suitable as a permanent control - it should be treated as a short-term bridge measure only. Full vendor advisory: https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-xjc6-g382-h942.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today