CVE-2026-108108 Details
Description
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.
An authentication bypass vulnerability has been identified in PHPNuxBill versions through 2025.3.20. The issue arises in the RADIUS CHAP verification process, where the Password::chap_verify() function incorrectly validates responses. This flaw allows attackers who know a valid customer or PPPoE username to authenticate via MikroTik hotspot or PPPoE CHAP, using any incorrect password. As a result, they can gain network access and utilize the affected customer's service plan.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-6f62-x25v-9686 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/hotspotbilling/phpnuxbill | [email protected] | ProductSource CodeVendor |
| https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/autoload/Password.php#L48 | [email protected] | Source CodeVendor |
| https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-6f62-x25v-9686 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-chap-authentication-bypass-via-password-chap-verify | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hotspotbilling PHPNuxBill | <= 2025.3.20 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |