CVE-2026-108109

Summary

PHPNuxBill contains a critical account takeover vulnerability where attackers can brute-force 6-digit OTP codes without rate limiting or account lockout, allowing them to hijack customer accounts by reading the new password from the HTTP response.

Exploitability

Exploitation is straightforward requiring only knowledge of a target username and takes advantage of the lack of OTP attempt limits or lockout mechanisms in the password reset flow.

Blast radius

The vulnerability could impact all customer accounts with known usernames, potentially allowing attackers to gain full access to user accounts and their associated data.

Detection

Monitor for repeated failed OTP verification attempts from the same IP address or user agent, and watch for successful OTP verification responses that return the new password in the HTTP response body.

Prioritized remediation

Implement rate limiting and account lockout mechanisms on the OTP verification endpoint in system/controllers/forgot.php, and upgrade to version 2025.3.21 or later which contains the fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.