PHPNuxBill Account Takeover Flaw Lets Attackers Hijack Customer Logins

Unauthenticated attackers can now hijack customer accounts in PHPNuxBill by exploiting a flaw in the password reset process. The vulnerability, tracked as CVE-2026-108109, allows threat actors to guess one-time passcodes repeatedly until they gain access, effectively bypassing standard security controls.

In plain English

When a user forgets their password, PHPNuxBill sends a six-digit code to verify their identity. This feature, found in the system/controllers/forgot.php file, is intended to ensure only the legitimate account owner can reset credentials. However, the current implementation lacks safeguards against rapid, automated guessing.

An attacker who knows a customer’s username can send thousands of requests to this endpoint, trying every possible six-digit combination. Because there are no limits on how many times a code can be guessed, and no account lockout mechanisms, the attacker will eventually find the correct code. Once the code is guessed, the system allows the attacker to set a new password. Crucially, the system then returns this newly set password in the HTTP response, giving the attacker immediate credentials to log in and take over the account.

The background

This issue is classified under CWE-307, which relates to improper restriction of excessive login attempts. The National Vulnerability Database (NVD) has assigned the vulnerability a CVSS score of 9.3, rating it as Critical. This high severity reflects the ease of exploitation and the complete loss of confidentiality, integrity, and availability for the affected account.

The vulnerability affects PHPNuxBill, a billing and automation platform often used by hotspot and ISP providers. According to NVD records, all versions of PHPNuxBill up to and including 2025.3.20 are affected. The software is also associated with HotspotBilling. Organizations using these versions are exposed to account takeover attacks that do not require prior authentication or complex technical skills.

What changes now

Security teams must assess their exposure immediately. Since the flaw allows unauthenticated access, external attackers can scan for vulnerable installations and exploit them without needing internal network access. The lack of rate limiting makes this a high-risk vector for mass account compromise.

No official patch or fix has been confirmed in the source material. Until a vendor update is released, organizations running affected versions face significant risk. Business leaders should prepare for potential incidents involving unauthorized account access and data exposure.

What to do and how to stay safe: PHPNuxBill

• Audit your PHPNuxBill version immediately to determine if you are running 2025.3.20 or an earlier release.
• Monitor server logs for unusual activity on the forgot.php endpoint, specifically looking for high volumes of requests from single IP addresses.
• Implement external rate limiting or firewall rules to restrict access to the password reset endpoint if possible, reducing the window for brute-force attacks.
• Review account access logs for any unexpected password changes or logins that may indicate successful exploitation.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-108109?

It is a critical vulnerability in PHPNuxBill that allows unauthenticated attackers to brute-force password reset codes and hijack customer accounts.

Which versions of PHPNuxBill are affected?

All versions up to and including 2025.3.20 are affected by this vulnerability.

Is there a patch available yet?

No fix has been confirmed in the source material; organizations should wait for a vendor update while monitoring for signs of exploitation.