Cross-Site Request Forgery in FOSSBilling Affects Guest Staff Login

CVE-2026-112374

What is CVE-2026-112374?

FOSSBilling versions before 0.8.9 are susceptible to a Cross-Site Request Forgery (CSRF) attack associated with the staff guest login endpoint. This vulnerability arises because the client authentication process inadequately protects the staff_login function. It lacks the necessary CSRF or Origin validation, enabling remote attackers to exploit this weakness. By deploying an auto-submitting HTML form with crafted credentials, attackers can unknowingly authenticate a victim's session to access staff accounts, compromising security and confidentiality.

References