Key points
- CVE-2026-108109 affects PHPNuxBill versions up to 2025.3.20 with a CVSS score of 9.3.
- The vulnerability resides in system/controllers/forgot.php within the customer password reset flow.
- Attackers can brute-force the six-digit OTP code without triggering any attempt limits or account lockouts.
The short version
- An unauthenticated attacker can hijack customer accounts by guessing the password reset code.
- The system returns the newly set password in the HTTP response after a successful guess.
- This issue impacts PHPNuxBill releases through version 2025.3.20, including the HotspotBilling product.
The details
The National Vulnerability Database lists CVE-2026-108109 as a critical issue with a CVSS score of 9.3. The flaw exists in the customer password reset functionality located in the system/controllers/forgot.php file. According to the NVD record, the vulnerability allows unauthenticated attackers to perform brute-force attacks against the six-digit one-time password code required for resets. There are no attempt limits or lockout mechanisms in place to stop these guesses.
An attacker who knows a valid customer username can continuously guess the OTP code. Once the correct code is entered, the server processes the password change. The application then returns the newly set password directly in the HTTP response body. This behavior allows the attacker to read the credentials and hijack the account immediately. The weakness is categorized under CWE-307, which relates to incorrect default permissions.
The context
PHPNuxBill is a billing and support automation system used by hosting providers. The HotspotBilling product, which is affected by this issue, is built on the PHPNuxBill platform. Versions up to and including 2025.3.20 contain the vulnerable code. The issue arises from the lack of rate limiting on the password reset endpoint and the insecure handling of sensitive data in the response.
What should you do?
System administrators should audit their PHPNuxBill installations to determine the current version. If the installation is at or below version 2025.3.20, the system is vulnerable. Review access logs for the forgot.php endpoint to identify potential brute-force attempts. Monitor for unusual password reset activity from single IP addresses.
Background: Rate limiting
Use this checklist to configure rate limiting that blocks abuse without breaking legitimate user flows. Group items by configuration, identification, and response handling. Each item includes a brief reason to ensure you implement controls that adapt to evolving attack patterns rather than static thresholds.
Read the full guide: Rate Limiting Implementation Checklist for Secure APIs
What to do and how to stay safe: PHPNuxBill
- Check your PHPNuxBill version and compare it against the affected range up to 2025.3.20.
- Monitor server logs for repeated requests to the password reset endpoint from single sources.
- Implement external rate limiting at the firewall or web application firewall level for reset flows.
- Enforce multi-factor authentication for administrative accounts to limit the impact of credential theft.
Step-by-step guide: Automatic Software Updates: 8 FAQs on Security and Risk
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of PHPNuxBill are affected by CVE-2026-108109?
All versions of PHPNuxBill up to and including version 2025.3.20 are affected.
How does an attacker exploit this vulnerability?
Attackers brute-force the six-digit OTP code in the password reset flow without facing lockouts.
Is authentication required to exploit this flaw?
No, the vulnerability allows unauthenticated attackers to perform the brute-force attack.
