Open Redirect Vulnerability in FOSSBilling System by FOSSBilling

CVE-2026-43924

What is CVE-2026-43924?

The FOSSBilling system contains an open redirect vulnerability due to the Redirect module's failure to validate the URL scheme of destination URLs configured by administrators. This security flaw allows attackers to set arbitrary external URLs as redirect targets, potentially enabling phishing attacks. Victims visiting a legitimate FOSSBilling URL may be unknowingly redirected to malicious sites controlled by attackers. The issue, present in versions prior to 0.8.0, generates a 301 (Moved Permanently) response, which can be cached by browsers, thereby increasing the risk of exploitation. Attacks require administrator access to modify redirects, making multi-admin environments or compromised administrator accounts particularly vulnerable. Users are advised to update to version 0.8.0 or restrict access to the Redirect module and audit existing redirect entries.

References