CVE-2026-53646 Details
Description
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already exists for a client (from a previous unexpired reset request), subsequent calls to the `reset_password` guest API endpoint reuse the existing token instead of generating a new one. The 15-minute validity window is anchored to the first request's `created_at` timestamp, not the time of the most recent email. An attacker who obtained the original reset link remains able to use it even after the victim requests a new reset, because the original token is never invalidated or rotated. Version 0.8.0 patches the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password` endpoint to minimize the window of opportunity, and/or manually clear expired `client_password_reset` records from the database after a client reports a suspected compromise.
A vulnerability in FOSSBilling versions 0.5.6 prior to 0.7.2 allows for password reset tokens to be reused, leading to potential account takeover. When a `ClientPasswordReset` record exists for a client, subsequent requests to the `reset_password` guest API endpoint reuse the existing token instead of generating a new one. The validity of the token is tied to the original request's timestamp, not the latest email notification. This means an attacker who intercepts the reset link can continue to use it, even after a new request is made, as the original token is never invalidated. Version 0.8.0 addresses this issue, but until then, clients can manually clear expired reset records from the database or apply per-IP rate limiting to the reset-password endpoint via a reverse proxy.
Users can update to FOSSBilling version 0.8.0, which patches this vulnerability. Additionally, expired `client_password_reset` records can be manually cleared from the database after a client reports a suspected compromise.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 6, 2026CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-vp66-w6rc-x32p | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FOSSBilling | >= 0.5.6, <= 0.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |