# CVE-2026-53644: FOSSBilling authorization bypass in Serviceapikey module

Source: https://junglewise.ai/threats/cve-2026-53644-fossbilling-authorization-bypass-in-serviceapikey-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-53644 · Severity: info · CVSS 8.6 · Published 2026-07-06

FOSSBilling, an open-source billing and client management platform, contains a flaw that allows customers to access and change service credentials even after their account has been suspended or canceled. This means a user who should no longer have access to a service can still view their old API keys or generate new ones, potentially maintaining unauthorized access to connected third-party systems. This bypasses the security controls intended to cut off service access during account termination or suspension.

Technologies: [FOSSBilling](https://junglewise.ai/threats/technologies/fossbilling). Vendors: [FOSSBilling](https://junglewise.ai/threats/vendors/fossbilling).

## Quick answers

**Is CVE-2026-53644 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53644 being exploited in the wild.

**How severe is CVE-2026-53644?** Informational severity, with a CVSS score of 8.6, published 6 July 2026.

**Which products and versions are affected?** FOSSBilling 0.5.3 - 0.7.2.

**Is there a fix for CVE-2026-53644?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53644 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53644?** Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in FOSSBilling due to missing order-state validation in the Serviceapikey module. While the frontend UI correctly hides management options for non-active orders (e.g., suspended or canceled), the underlying API endpoints `/api/client/order/service` and `/api/client/serviceapikey/reset` do not verify if an order is active before processing requests. An authenticated attacker can bypass the UI restrictions to retrieve cleartext API keys or rotate them, potentially maintaining access to downstream services that trust these credentials. The issue is resolved in version 0.8.0 by implementing the existing `isActive()` helper check within the affected API controllers.

## Affected products

- FOSSBilling FOSSBilling 0.5.3 - 0.7.2

## Timeline

- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: NVD publication date

## References

- [https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-qf6j-vq68-qmfh](https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-qf6j-vq68-qmfh)

## Related threats

- [FOSSBilling stored XSS in support ticket notes](https://junglewise.ai/threats/cve-2026-111048-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling CSRF vulnerability in staff guest login endpoint](https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery)
- [FOSSBilling email enumeration via guest signup endpoint](https://junglewise.ai/threats/cve-2026-111056-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling path traversal in template_exists endpoint](https://junglewise.ai/threats/cve-2026-111053-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling authorization bypass in extension configuration management](https://junglewise.ai/threats/cve-2026-111046-fossbilling-is-an-open-source-billing-and-client-management)