CVE-2026-108109 PUBLISHED

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

• tonghuaroot finder
• leediay153 from Viettel Post reporter

• GitHub Security Advisory (GHSA-337r-rrrc-r559)
• Patch Commit
• https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/controllers/forgot.php#L41
• https://github.com/hotspotbilling/phpnuxbill
• VulnCheck Advisory: PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

• Improper Restriction of Excessive Authentication Attempts CWE