{"id":"CVE-2026-108109","published":"2026-10-09T15:17:12.047","lastModified":"2026-10-09T18:17:06.727","description":"PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-307"],"vendors":[],"products":[],"references":[{"url":"https://github.com/hotspotbilling/phpnuxbill","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/controllers/forgot.php#L41","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/commit/c3c2a92d468af91136d747b75142ed72f10320cc","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-337r-rrrc-r559","tags":[]},{"url":"https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-account-takeover-via-brute-forceable-password-reset-code","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-337r-rrrc-r559","tags":[]}],"exploitRefs":[{"url":"https://github.com/hotspotbilling/phpnuxbill","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/controllers/forgot.php#L41","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/commit/c3c2a92d468af91136d747b75142ed72f10320cc","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-337r-rrrc-r559","tags":[]},{"url":"https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-337r-rrrc-r559","tags":[]}],"hasPoc":true,"ai":{"summary":"PHPNuxBill contains a critical account takeover vulnerability where attackers can brute-force 6-digit OTP codes without rate limiting or account lockout, allowing them to hijack customer accounts by reading the new password from the HTTP response.","exploitability":"Exploitation is straightforward requiring only knowledge of a target username and takes advantage of the lack of OTP attempt limits or lockout mechanisms in the password reset flow.","blast_radius":"The vulnerability could impact all customer accounts with known usernames, potentially allowing attackers to gain full access to user accounts and their associated data.","remediation":"Implement rate limiting and account lockout mechanisms on the OTP verification endpoint in system/controllers/forgot.php, and upgrade to version 2025.3.21 or later which contains the fix for this vulnerability.","detection":"Monitor for repeated failed OTP verification attempts from the same IP address or user agent, and watch for successful OTP verification responses that return the new password in the HTTP response body.","tags":["auth-bypass","account-takeover","web","brute-force"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:48:57.097Z"}}