Update PHPNuxBill before 2025.3.21 to block unauthenticated OTP guessing and credential theft in password resets

A critical vulnerability in PHPNuxBill allows attackers to hijack customer accounts by brute-forcing password reset codes. The flaw exists in the application’s forgot password controller and lacks any attempt limits or lockout mechanisms.

What happened

The National Vulnerability Database recorded CVE-2026-108109 as a critical severity issue with a CVSS score of 9.3. This flaw affects PHPNuxBill versions through 2025.3.20, which are widely used for hotspot billing and network management. The vulnerability is located in the system/controllers/forgot.php file, which handles the customer password reset flow.

An attacker does not need to be logged in to exploit this weakness. If the attacker knows a valid customer username, they can repeatedly guess the six-digit one-time password (OTP) code. The application does not enforce any rate limiting or account lockout after failed attempts. This allows the attacker to eventually guess the correct code through brute-force methods.

Once the correct OTP is submitted, the application sends the newly set password back in the HTTP response body. The attacker can then read this password directly from the response data. This gives the attacker full access to the victim’s account without needing the original credentials.

Why it matters

This vulnerability is classified under CWE-307, which relates to incorrect default permissions or insufficient authorization controls. The lack of brute-force protection on a six-digit code makes the security control ineffective. A six-digit code has only one million possible combinations, which modern computers can guess in seconds.

For organizations using PHPNuxBill, this means any customer account with a known username is at immediate risk. Attackers can automate the guessing process to take over accounts at scale. The exposure of the new password in the HTTP response further simplifies the attack, removing any need for session hijacking or cookie theft.

The fix

• Verify if your PHPNuxBill installation is version 2025.3.20 or earlier.
• Check for an official security update from the vendor that addresses CVE-2026-108109.
• Implement server-side rate limiting on the forgot password endpoint if an update is not yet available.
• Monitor HTTP response logs for unusual password reset activity from single IP addresses.

Background: IP addresses

An IP address is a unique numerical label assigned to every device connected to a computer network using the Internet Protocol. It functions like a postal address, ensuring data packets reach the correct destination. Devices use these addresses to communicate, and routers direct traffic based on them.

Read the full guide: IP Addresses Explained: How Network Identity Works

What to do and how to stay safe: PHPNuxBill

• Audit your PHPNuxBill version immediately to confirm if you are running an affected release.
• Enforce strict rate limiting on all password reset endpoints at the web server or firewall level.
• Monitor authentication logs for rapid, repeated failed login attempts from the same source.
• Educate users to report any unexpected password reset emails or notifications they receive.

Step-by-step guide: Account Takeover Warning Signs You Miss and How to React

General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of PHPNuxBill are affected by this vulnerability?

All versions of PHPNuxBill up to and including 2025.3.20 are affected by CVE-2026-108109.

Do attackers need to be logged in to exploit this flaw?

No, the vulnerability allows unauthenticated attackers to brute-force the reset code if they know the username.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-108109 as critical with a CVSS score of 9.3.