Which versions of FOSSBilling are affected by CVE-2026-53646?

FOSSBilling versions 0.5.6-0.7.2 contain a password reset token vulnerability (CVE-2026-53646) that enables attackers to hijack customer accounts using previously captured reset links, even after…

How to fix or mitigate CVE-2026-53646?

Within 24 hours: Identify all FOSSBilling instances running affected versions 0.5.6-0.7.2; invalidate all active ClientPasswordReset tokens; review access logs for suspicious account modifications. Within 7 days: Validate FOSSBilling 0.8.0 patch in test environment and finalize deployment plan. Within 30 days: Deploy version 0.8.0 to all production systems; confirm token rotation is functioning; notify affected customers of remediation.

FOSSBilling CVE-2026-53646

Q: What is the CVSS score of CVE-2026-53646?

CVE-2026-53646 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-07-06 security-advisories@github.com

Apache Information Disclosure Nginx

7.7

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network guest endpoint (PR:N) but AC:H because the attacker must already hold the unexpired original link, and UI:R since the victim must trigger a reset; account takeover yields full C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 23:38 vuln.today

CVE Published

Jul 06, 2026 - 23:16 cve.org

HIGH 7.7

DescriptionCVE.org

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a ClientPasswordReset record already exists for a client (from a previous unexpired reset request), subsequent calls to the reset_password guest API endpoint reuse the existing token instead of generating a new one. The 15-minute validity window is anchored to the first request's created_at timestamp, not the time of the most recent email. An attacker who obtained the original reset link remains able to use it even after the victim requests a new reset, because the original token is never invalidated or rotated. Version 0.8.0 patches the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the /client/reset-password endpoint to minimize the window of opportunity, and/or manually clear expired client_password_reset records from the database after a client reports a suspected compromise.

AnalysisAI

Account takeover in FOSSBilling 0.5.6 through 0.7.2 arises because the reset_password guest API endpoint reuses an existing, unexpired ClientPasswordReset token rather than rotating it on each request. An attacker who has captured a victim's earlier reset link retains a valid path to hijack the account even after the victim requests a fresh reset, since the original token is never invalidated and its 15-minute window is anchored to the first request. No public exploit is identified at time of analysis, and the CVSS 4.0 score is 7.7 (High); version 0.8.0 fixes the flaw.

Technical ContextAI

FOSSBilling is a PHP-based open-source billing and client management platform. The weakness is a classic CWE-640 (Weak Password Recovery Mechanism): the password-reset workflow persists a ClientPasswordReset record keyed to a client, and when a record already exists from a prior unexpired request, the reset_password handler reuses that same token and created_at timestamp instead of generating and persisting a new one. Because token validity (15 minutes) is computed from the original created_at rather than the most recent email send, and because a new request neither deletes nor rotates the prior token, any previously issued link stays live for its full original lifetime. The client_password_reset database table therefore holds a single reusable token per client rather than a per-request, single-use secret.

Affected ProductsAI

FOSSBilling versions 0.5.6 through 0.7.2 are affected, and the issue is fixed in version 0.8.0. No CPE strings were supplied in the input. The authoritative source is the FOSSBilling GitHub Security Advisory GHSA-vp66-w6rc-x32p (https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-vp66-w6rc-x32p); no separate NVD CPE configuration was provided.

RemediationAI

Vendor-released patch: 0.8.0 - upgrade FOSSBilling to 0.8.0 or later, which corrects token rotation/invalidation, per advisory GHSA-vp66-w6rc-x32p (https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-vp66-w6rc-x32p). If immediate upgrade is not possible, the vendor documents two workarounds: configure a reverse proxy (Nginx, Apache, or Cloudflare) to enforce per-IP rate limiting on the /client/reset-password endpoint to shrink the window of opportunity (trade-off: rate limiting curbs automated abuse but does not invalidate an already-captured token, so it is mitigation not remediation), and manually clear expired rows from the client_password_reset database table after a client reports a suspected compromise (trade-off: reactive and manual, effective only once abuse is suspected). Combine both interim controls until 0.8.0 is deployed.