CVE-2026-108108 in PHPNuxBill
Summary
by MITRE • 10/09/2026
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within PHPNuxBill versions up to 2025.3.20 represents a critical authentication bypass flaw rooted in the implementation of the RADIUS Challenge-Handshake Authentication Protocol verification logic. Specifically, the function Password::chap_verify() exhibits a fundamental logical error where it returns true even when the supplied response does not match the expected cryptographic hash derived from the challenge and password. This defect effectively neutralizes the security mechanism intended to validate user credentials during the CHAP handshake process. In standard CHAP operations, the server sends a random challenge value which the client must encrypt using their shared secret (password) before sending it back for verification. The flaw described indicates that the system fails to perform this comparison correctly or ignores the result of the mismatch, thereby granting access regardless of whether the correct password was provided.
This technical deficiency allows attackers who possess knowledge of a valid username associated with either a customer account or a PPPoE session to bypass authentication entirely. By supplying any arbitrary string as the password during the login attempt through MikroTik hotspot interfaces or standard PPPoE CHAP connections, an attacker can successfully authenticate and establish network access. The operational impact is severe, as it enables unauthorized users to consume bandwidth and services allocated to legitimate customers without needing their actual credentials beyond the username itself. This not only leads to direct financial loss for service providers through resource theft but also compromises the integrity of billing systems that rely on accurate authentication logs for usage tracking and customer management.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to adequately verify identity before granting access. It is further categorized under CWE-306 Missing Authentication for Critical Function if viewed in the context of administrative or high-value resource access, though primarily it fits the broader scope of authentication bypasses where credentials are not validated correctly. In terms of adversary tactics, this flaw facilitates initial access and lateral movement within a network environment by allowing an attacker to masquerade as a legitimate user. This aligns with MITRE ATT&CK technique T1078 Valid Accounts, specifically the sub-technique of using stolen or guessed credentials, although in this case, only partial credential information (the username) is required due to the verification logic failure.
Mitigation strategies must focus on immediate code remediation and architectural hardening. The primary action involves correcting the Password::chap_verify() function to ensure it strictly returns false when the calculated response does not match the expected value derived from the challenge and the stored password hash. Developers should implement rigorous unit testing for authentication modules, particularly focusing edge cases involving mismatched credentials. Additionally, service providers should enforce multi-factor authentication where possible to add a layer of security that is independent of the CHAP mechanism's integrity. Network monitoring tools should be configured to detect anomalous login patterns, such as multiple failed attempts followed by successful logins with incorrect passwords or high-volume data usage from newly authenticated sessions associated with known usernames. Regular audits of third-party billing and authentication libraries are essential to identify similar logical flaws in other components before they can be exploited.