CVE-2026-108109 — PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attacker…
Published: 2026-10-09 · CVSS: 9.3 · CVSS 4.0
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7