# CVE-2026-112374: FOSSBilling CSRF vulnerability in staff guest login endpoint

Source: https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-112374 · Severity: medium · CVSS 4.3 · Published 2026-10-30

FOSSBilling is an open-source billing and hosting management platform. Versions before 0.8.9 contain a cross-site request forgery (CSRF) vulnerability in the staff login endpoint that allows attackers to trick users into logging into attacker-controlled staff accounts without their knowledge. An attacker could host a malicious webpage that silently logs a victim's browser into the attacker's account, potentially leading to unauthorized access to billing and hosting management functions.

Technologies: [FOSSBilling](https://junglewise.ai/threats/technologies/fossbilling). Vendors: [FOSSBilling](https://junglewise.ai/threats/vendors/fossbilling).

## Quick answers

**Is CVE-2026-112374 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112374 being exploited in the wild.

**How severe is CVE-2026-112374?** Medium severity, with a CVSS score of 4.3, published 30 October 2026.

**Which products and versions are affected?** FOSSBilling before 0.8.9.

**Is there a fix for CVE-2026-112374?** Yes: fixed in 0.8.9. Until then: Upgrade to FOSSBilling 0.8.9 or later, which implements CSRF token validation and same-origin context requirements for all guest authentication endpoints including staff login. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112374 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-112374?** Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.8.9

Upgrade to FOSSBilling 0.8.9 or later, which implements CSRF token validation and same-origin context requirements for all guest authentication endpoints including staff login.

## Technical details

The vulnerability exists in the POST /api/guest/staff/login endpoint where the checkGuestClientAuthentication() function fails to validate CSRF tokens or Origin headers, unlike the allowlisted client_login and client_create endpoints. This permits cross-origin form submission attacks where an attacker can craft an auto-submitting HTML form with attacker-controlled credentials to force authentication. The attack requires user interaction (visiting a malicious page) but no authentication or special network position.

## Affected products

- FOSSBilling FOSSBilling before 0.8.9

## Timeline

- 2026-10-30: disclosed
- 2026-10-23: patched

## References

- [https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9](https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9)
- [https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-h7w3-wp25-gf86](https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-h7w3-wp25-gf86)

## Related threats

- [FOSSBilling stored XSS in support ticket notes](https://junglewise.ai/threats/cve-2026-111048-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling email enumeration via guest signup endpoint](https://junglewise.ai/threats/cve-2026-111056-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling path traversal in template_exists endpoint](https://junglewise.ai/threats/cve-2026-111053-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling authorization bypass in extension configuration management](https://junglewise.ai/threats/cve-2026-111046-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling file overwrite via filename collision in downloadable products](https://junglewise.ai/threats/cve-2026-53648-fossbilling-file-overwrite-via-filename-collision-in-downloadable)