CVE-2026-43926 Details
Description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to `/api/*` routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). An attacker can submit unlimited token guesses to the password reset confirmation endpoint with no throttling applied. However, practical exploitability is significantly mitigated by the current token generation, which uses `hash('sha256', random_bytes(32))`, providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including `/staff/email/:hash` (admin password reset confirmation) and `/client/confirm-email/:hash` (email confirmation). Version 0.8.0 fixes the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password-confirm/*` and `/staff/email/*` paths and/or use a WAF rule to limit request rates to these endpoints.
A vulnerability exists in FOSSBilling, a billing and client management system, in versions through 0.7.2. The issue arises because the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is managed by a non-API controller and is not subject to the application's rate limiter, which only affects `/api/*` routes. This oversight allows attackers to repeatedly test the endpoint for valid reset tokens without any per-IP request limits, attempt tracking, or lockout mechanisms. The endpoint provides feedback on token validity, returning HTTP 200 for valid tokens and HTTP 302 for redirects. Although this flaw could be exploited to guess tokens, the effectiveness is reduced by the token's secure generation method, which uses SHA-256 hashing of random bytes, offering 256 bits of entropy. Tokens expire after 15 minutes and are removed after use. This same lack of rate limiting applies to other authentication-related routes served by non-API controllers, such as admin password reset and email confirmation endpoints.
Users are advised to upgrade to FOSSBilling version 0.8.0 or later, where this vulnerability has been fixed. Additionally, configure a reverse proxy to apply per-IP rate limiting to the affected endpoints or use a Web Application Firewall (WAF) rule to restrict request rates to these routes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0 | [email protected] | Release NotesVendor |
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-cqqm-p3x5-9fqg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-204 | Observable Response Discrepancy | [email protected] |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FOSSBilling | <= 0.7.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |