CVE-2026-108109 Details
Description
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
A vulnerability allowing account takeover has been identified in PHPNuxBill versions through 2025.3.20. The issue arises in the password reset process, specifically within the 'system/controllers/forgot.php' file. Unauthenticated attackers can exploit this vulnerability by brute-forcing a 6-digit one-time password (OTP) required for verification. The OTP is generated using a weak random number generator, 'mt_rand', and the verification step lacks any attempt limits or lockout mechanisms. Once the OTP is successfully guessed, the attacker can read the new password from the response and take over the account.
Users can update to PHPNuxBill version 2025.3.21 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hotspotbilling PHPNuxBill | <= 2025.3.20 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |