{"id":"CVE-2026-112374","published":"2026-10-30T13:18:29.093","lastModified":"2026-10-30T13:18:29.223","description":"FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists client_login and client_create, leaving staff_login without CSRF or Origin validation. Attackers can host an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9","tags":[]},{"url":"https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-h7w3-wp25-gf86","tags":[]},{"url":"https://www.vulncheck.com/advisories/fossbilling-before-login-csrf-via-staff-guest-login-api","tags":[]}],"exploitRefs":[{"url":"https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9","tags":[]},{"url":"https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-h7w3-wp25-gf86","tags":[]}],"hasPoc":true,"ai":null}