PHPNuxBill Unauthenticated Brute-Force Bug Exposes Reset Passwords in Versions Through 2025.3.20
An unauthenticated brute-force flaw in PHPNuxBill’s password reset flow allows attackers to hijack accounts by guessing 6-digit codes without limits.
Key points
- CVE-2026-108109 carries a CVSS score of 9.3, rated Critical by the NVD.
- The vulnerability affects PHPNuxBill versions up to and including 2025.3.20.
- Attackers can retrieve newly set passwords from HTTP responses after guessing codes.
PHPNuxBill contains a critical account takeover vulnerability in its customer password reset functionality. According to the National Vulnerability Database, the flaw in system/controllers/forgot.php allows unauthenticated attackers to brute-force the six-digit one-time password code. This issue affects all versions of the software through 2025.3.20, including those used by HotspotBilling.
Root cause
The core issue stems from a lack of rate limiting and lockout mechanisms in the password reset controller. The application fails to restrict the number of attempts an attacker can make when guessing the OTP code. This weakness aligns with CWE-307, which identifies improper restriction of excessive authentication attempts.
Without these safeguards, an automated script can rapidly iterate through possible six-digit combinations. The server processes each request without detecting the abnormal volume of failed guesses. This design oversight leaves the authentication flow exposed to sustained brute-force attacks from external actors.
Attack path
An attacker begins by identifying a valid customer username within the PHPNuxBill system. With this information, they target the forgot.php endpoint to initiate the password reset process. The system generates a six-digit OTP code and sends it to the associated account, typically via email.
The attacker then submits multiple requests to verify the OTP code, guessing different combinations. Because there are no attempt limits, the attacker can continue guessing until the correct code is found. Once the correct code is submitted, the system allows the password change to proceed.
Crucially, the HTTP response from the server includes the newly set password in plain text. This allows the attacker to immediately read the new credentials and hijack the account. The entire process requires no prior authentication or existing session cookies.
Affected versions
- PHPNuxBill version 2025.3.20
- All previous versions of PHPNuxBill
- HotspotBilling installations running PHPNuxBill up to 2025.3.20
Mitigation
- Update PHP
Background: Account takeover
Account takeover fraud occurs when attackers hijack your credentials to access personal or financial services. They use stolen data, social engineering, or weak security questions to bypass defenses. You stop this by enforcing hardware-based multi-factor authentication, monitoring session logs, and treating password resets as the highest-risk activity.
Read the full guide: Account Takeover Fraud: How Attackers Steal Identities and How You Stop It
What to do and how to stay safe
- Asset discovery is only the first step; context determines risk.
- Internal assets become external risks through cloud misconfigurations.
- Prioritization requires correlating vulnerability data with business criticality.
Attack surface management is continuous, contextual, and human-guided. Start by mapping your external assets and prioritizing risks based on business impact.
Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
