Executive brief
FOSSBilling is an open-source platform used by businesses to manage client billing and support. A security flaw in the password reset process allows an old reset link to remain active even if a user requests a new one. If an attacker manages to see the original reset link (for example, through shared access or intercepted communication), they could use it to hijack the customer's account and access sensitive billing data.
Technical details
A vulnerability in the `reset_password` guest API endpoint in `src/modules/Client/Api/Guest.php` leads to token reuse. When a password reset is requested, the system checks for an existing `ClientPasswordReset` record; if found, it reuses the existing hash and maintains the original `created_at` timestamp rather than generating a new token. Because the 15-minute expiry window is anchored to the initial creation time and the token is not invalidated by subsequent requests, an attacker who has obtained the original token can still use it to change the user's password even after the victim attempts to refresh the request. This issue is resolved in version 0.8.0 by ensuring proper token rotation.
Affected products
- FOSSBilling FOSSBilling >= 0.5.6, <= 0.7.2
Timeline
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE published to NVD