Vulnerability in FOSSBilling's Password Reset Functionality

CVE-2026-43926

What is CVE-2026-43926?

FOSSBilling, an open-source billing and client management system, contains a vulnerability in its password reset confirmation endpoint prior to version 0.8.0. This endpoint lacks adequate rate limiting and allows attackers to probe for valid reset tokens without restrictions. The endpoint is susceptible to an oracle-style attack, differentiating between valid and invalid tokens based on the response it provides. Although the token generation maintains high entropy and has expiration mechanisms, the lack of request throttling makes it easier for attackers to exploit this oversight. Other authentication routes, including admin password reset and email confirmation, face similar risks. Upgrading to version 0.8.0 mitigates this vulnerability, and additional protective measures such as implementing a reverse proxy for rate limiting or applying WAF rules are recommended.

References