CVE-2026-42341 Details
Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to `/ipn.php` at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.
A critical unauthenticated payment bypass vulnerability has been identified in FOSSBilling versions 0.6.0 prior to 0.7.2. This vulnerability exists in the IPN callback endpoint when the Custom payment adapter is enabled. An attacker can exploit this issue by sending a single crafted HTTP request to mark any unpaid invoice as paid, crediting the associated client account without making an actual payment. The vulnerability arises from a combination of factors, including the IPN processing path bypassing validation checks and the Custom payment adapter lacking source verification.
Users can upgrade to FOSSBilling version 0.8.0, which patches this vulnerability. If the Custom payment gateway is not actively needed, it should be disabled. Additionally, access to '/ipn.php' can be restricted at the web server level, though this may interfere with legitimate payment callback processing.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 6, 2026CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-5493-9m76-2qrr | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FOSSBilling | >= 0.6.0, <= 0.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |