CVE-2026-108109 in PHPNuxBill
Summary
by MITRE • 10/09/2026
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in PHPNuxBill versions through 2025.3.20 represents a critical authentication bypass mechanism rooted in flawed implementation of the customer password reset workflow. Specifically located within the system/controllers/forgot.php module, this flaw allows unauthenticated attackers to compromise user accounts by exploiting weaknesses in the one-time passcode verification process. The core issue lies in the absence of rate limiting or account lockout mechanisms during the OTP validation phase. This design oversight enables adversaries to perform brute-force attacks against the six-digit numeric code with no restrictions on the number of attempts, effectively reducing the security boundary from a high-entropy random value to a trivially guessable sequence given sufficient time and computational resources.
From a technical perspective, the vulnerability stems from insufficient validation controls in the server-side logic handling password reset requests. When an attacker provides a valid customer username, the system generates a six-digit OTP and transmits it via email or SMS depending on configuration. However, the subsequent verification endpoint does not enforce any throttling policies such as exponential backoff, temporary account suspension after failed attempts, or CAPTCHA challenges to mitigate automated guessing. This lack of protective measures means that an attacker can script requests to iterate through all possible combinations from 000000 to 999999 with minimal latency. Given the relatively small keyspace of one million possibilities and modern computing capabilities, this brute-force operation can be completed in a very short timeframe, often within minutes or even seconds depending on network conditions and server response times.
The operational impact of this vulnerability is severe, leading directly to account takeover without requiring prior authentication credentials. Once an attacker successfully guesses the correct OTP code, they are granted access to reset the user's password. Crucially, the implementation flaw extends beyond mere authorization bypass; it also involves information disclosure in the HTTP response. The system returns the newly set password or a token that allows immediate login within the same transaction flow. This means that after guessing the OTP, the attacker can instantly retrieve the new credentials from the server's reply and log into the victim’s account as if they were the legitimate user. This dual failure of authentication control and sensitive data exposure significantly amplifies the risk profile, allowing for seamless hijacking of customer accounts, potential access to stored payment information, personal identifiable information, and order history.
In terms of industry standard classifications, this vulnerability aligns with CWE-307 Improper Restriction of Excessive Authentication Attempts, which describes scenarios where systems fail to limit repeated login or authentication attempts. Additionally, it relates to CWE-640 Weak Password Recovery Mechanism for Forgotten Password, as the reset process does not adequately protect against guessing attacks. From an offensive security framework perspective, this behavior maps to MITRE ATT&CK technique T1078 Valid Accounts and specifically sub-technique T1528 Steal Application Access Token if tokens are involved, or more broadly under Initial Access tactics involving credential stuffing or brute force due to the lack of lockout mechanisms. The ability to read the password from the HTTP response also touches upon CWE-209 Generation of Error Message Containing Sensitive Information, although in this context it is part of a larger authentication bypass chain rather than just an error leak.
To mitigate this vulnerability, immediate remediation steps should focus on implementing robust rate limiting and account lockout policies for all password reset endpoints. The system must enforce strict limits on the number of OTP verification attempts per user or IP address within a defined time window, typically capping at three to five failed attempts before requiring additional verification such as CAPTCHA or temporary suspension. Furthermore, developers should ensure that sensitive data like new passwords are never returned in plaintext HTTP responses during reset operations; instead, users should be required to log in manually with the newly set password after receiving a confirmation notification. Implementing multi-factor authentication for administrative and high-value customer accounts can also provide an additional layer of defense against such automated attacks. Regular security audits focusing on authentication flows and adherence to OWASP Authentication Cheat Sheet guidelines are recommended to prevent similar weaknesses in future updates or related modules.