# CVE-2026-53646: FOSSBilling weak password recovery mechanism in Client API

Source: https://junglewise.ai/threats/cve-2026-53646-fossbilling-weak-password-recovery-mechanism-in-client-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-53646 · Severity: info · CVSS 7.7 · Published 2026-07-06

FOSSBilling is an open-source platform used by businesses to manage client billing and support. A security flaw in the password reset process allows an old reset link to remain active even if a user requests a new one. If an attacker manages to see the original reset link (for example, through shared access or intercepted communication), they could use it to hijack the customer's account and access sensitive billing data.

Technologies: [FOSSBilling](https://junglewise.ai/threats/technologies/fossbilling). Vendors: [FOSSBilling](https://junglewise.ai/threats/vendors/fossbilling).

## Quick answers

**Is CVE-2026-53646 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53646 being exploited in the wild.

**How severe is CVE-2026-53646?** Informational severity, with a CVSS score of 7.7, published 6 July 2026.

**Which products and versions are affected?** FOSSBilling >= 0.5.6, <= 0.7.2.

**Is there a fix for CVE-2026-53646?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53646 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53646?** Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the `reset_password` guest API endpoint in `src/modules/Client/Api/Guest.php` leads to token reuse. When a password reset is requested, the system checks for an existing `ClientPasswordReset` record; if found, it reuses the existing hash and maintains the original `created_at` timestamp rather than generating a new token. Because the 15-minute expiry window is anchored to the initial creation time and the token is not invalidated by subsequent requests, an attacker who has obtained the original token can still use it to change the user's password even after the victim attempts to refresh the request. This issue is resolved in version 0.8.0 by ensuring proper token rotation.

## Affected products

- FOSSBilling FOSSBilling >= 0.5.6, <= 0.7.2

## Timeline

- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE published to NVD

## References

- [https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-vp66-w6rc-x32p](https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-vp66-w6rc-x32p)

## Related threats

- [FOSSBilling stored XSS in support ticket notes](https://junglewise.ai/threats/cve-2026-111048-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling CSRF vulnerability in staff guest login endpoint](https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery)
- [FOSSBilling email enumeration via guest signup endpoint](https://junglewise.ai/threats/cve-2026-111056-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling path traversal in template_exists endpoint](https://junglewise.ai/threats/cve-2026-111053-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling authorization bypass in extension configuration management](https://junglewise.ai/threats/cve-2026-111046-fossbilling-is-an-open-source-billing-and-client-management)