PHPNuxBill EUVD-2026-95810

Exploitation targets the customer password-reset flow in system/controllers/forgot.php and works against default configurations - no special feature or setting must be enabled. Concrete prerequisites: (1) the attacker must know a valid customer username to initiate the reset, and (2) brute-force guessing of the 6-digit otp_code (roughly one million values) must complete within the OTP's validity window (~600 seconds per the patch's preserved filemtime). The limiting factors are the username requirement and the time-boxed window; no authentication, user interaction, or non-default configuration is needed, and the pre-patch absence of any attempt limit or lockout makes the brute force feasible.

All exploitability signals point to a genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact (VC:H/VI:H), consistent with full account takeover, and the description corroborates every metric: unauthenticated attackers brute-force a 6-digit OTP in the password-reset flow with no attempt limits or lockout (CWE-307). The vendor patch and the GitHub commit diff confirm the root cause (missing attempt budget, plus a weak mt_rand OTP and the password echoed in the response), so the technical claim is strongly substantiated. Mitigating factors keep this short of trivial mass-exploitation: the attacker must already know a valid customer username and must complete the brute force within the OTP validity window (the patch preserves an ~600s filemtime window). No EPSS score was provided, and the vulnerability is NOT in CISA KEV; no public exploit code was supplied in the input. Active exploitation is therefore unconfirmed - the high score reflects strong intrinsic exploitability (reported by VulnCheck, vendor-patched) rather than evidence of in-the-wild attacks, and PHPNuxBill's niche footprint limits the realistic blast radius.

An unauthenticated attacker who knows a target customer's username submits a password-reset request to system/controllers/forgot.php, then repeatedly posts guesses against the 6-digit otp_code at step 2. Because no lockout or attempt limit existed, the attacker brute-forces the ~1,000,000-value space within the reset window and the application returns the newly generated password in the HTTP response, yielding full account takeover. No public exploit code was identified in the provided data, but the attack is scriptable and requires no authentication or user interaction.