PHPNuxBill: Account takeover via brute-forceable password reset code

Summary

PHPNuxBill through 2025.3.20 contains a flaw in the customer password reset flow in system/controllers/forgot.php. An unauthenticated attacker who knows a customer username can brute-force the 6-digit OTP code, because the application enforces no attempt limit or lockout. The new password is then returned in the HTTP response, which allows the attacker to take over the customer account.

Affected

• PHPNuxBill through 2025.3.20 (vendor range: 0 to <= 2025.3.20)
• Default configuration: unaffected per CNA record (as recorded by VulnCheck); verify against your own installation

Fixed in

Unknown. A fix commit is referenced (c3c2a92d468af91136d747b75142ed72f10320cc), but no fixed release has been confirmed.

Workaround

• No vendor workaround documented in the sources reviewed.
• Restrict access to the customer portal and forgot.php (VPN, IP allowlist, or disable self-service password reset if not needed).
• Add rate limiting or WAF rules on the password reset endpoint.

Exploitation

• CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: total.
• No public exploit listed and no evidence of in-the-wild exploitation at the time of research; not in CISA KEV.
• Authentication not required; attacker needs a valid customer username.

Our recommendation

• Check whether PHPNuxBill is installed and reachable from the internet; treat internet-exposed instances as critical.
• Restrict access to the customer portal and the reset function as described under workaround.
• Upgrade to a release containing the fix once confirmed in the GHSA advisory or the repository.
• Review web logs for many repeated OTP submissions from one source and reset customer passwords if abuse is suspected.
• Triage together with CVE-2026-108107 and CVE-2026-108108 affecting the same product.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-337r-rrrc-r559 github.com
• VulnCheck advisory www.vulncheck.com
• Fix commit c3c2a92d github.com
• forgot.php at 2025.3.13 github.com
• OSV entry CVE-2026-108109 osv.dev
• Strix CVE record www.strix.ai
• Vulners Rapid7 entry (EPSS) vulners.com
• OpenCVE vendor list app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:43.