CVE-2026-112374: FOSSBilling CSRF vulnerability in staff guest login endpoint

CVE-2026-112374 · Severity: medium · CVSS 4.3 · Published 2026-10-30

FOSSBilling is an open-source billing and hosting management platform. Versions before 0.8.9 contain a cross-site request forgery (CSRF) vulnerability in the staff login endpoint that allows attackers to trick users into logging into attacker-controlled staff accounts without their knowledge. An attacker could host a malicious webpage that silently logs a victim's browser into the attacker's account, potentially leading to unauthorized access to billing and hosting management functions.

Technologies: FOSSBilling. Vendors: FOSSBilling.

Quick answers

Is CVE-2026-112374 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-112374 being exploited in the wild.
How severe is CVE-2026-112374?
Medium severity, with a CVSS score of 4.3, published 30 October 2026.
Which products and versions are affected?
FOSSBilling before 0.8.9.
Is there a fix for CVE-2026-112374?
Yes: fixed in 0.8.9. Until then: Upgrade to FOSSBilling 0.8.9 or later, which implements CSRF token validation and same-origin context requirements for all guest authentication endpoints including staff login. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112374 attacked?
It is attacked over the network.
Am I affected by CVE-2026-112374?
Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 0.8.9

Upgrade to FOSSBilling 0.8.9 or later, which implements CSRF token validation and same-origin context requirements for all guest authentication endpoints including staff login.

Technical details

The vulnerability exists in the POST /api/guest/staff/login endpoint where the checkGuestClientAuthentication() function fails to validate CSRF tokens or Origin headers, unlike the allowlisted client_login and client_create endpoints. This permits cross-origin form submission attacks where an attacker can craft an auto-submitting HTML form with attacker-controlled credentials to force authentication. The attack requires user interaction (visiting a malicious page) but no authentication or special network position.

Affected products

  • FOSSBilling FOSSBilling before 0.8.9

Timeline

  • 2026-10-30: disclosed
  • 2026-10-23: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.