CVE-2026-43926
FOSSBilling's password reset confirmation endpoint lacks rate limiting
Description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to `/api/*` routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). An attacker can submit unlimited token guesses to the password reset confirmation endpoint with no throttling applied. However, practical exploitability is significantly mitigated by the current token generation, which uses `hash('sha256', random_bytes(32))`, providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including `/staff/email/:hash` (admin password reset confirmation) and `/client/confirm-email/:hash` (email confirmation). Version 0.8.0 fixes the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password-confirm/*` and `/staff/email/*` paths and/or use a WAF rule to limit request rates to these endpoints.
INFO
Published Date :
June 4, 2026, 2:16 p.m.
Last Modified :
July 22, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update FOSSBilling to version 0.8.0 or later.
- Configure reverse proxy rate limiting for auth routes.
- Implement WAF rules for request rate limiting.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-43926.
| URL | Resource |
|---|---|
| https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0 | |
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-cqqm-p3x5-9fqg |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-43926 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-43926
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-43926 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-43926 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 22, 2026
Action Type Old Value New Value Added Translation Title: FOSSBilling, Description: FOSSBilling es un sistema de gestión de facturación y de clientes gratuito y de código abierto. Antes de la versión 0.8.0, el endpoint de confirmación de restablecimiento de contraseña '/client/reset-password-confirm/:hash' es gestionado por un controlador que no es una API y no está cubierto por el limitador de velocidad de FOSSBilling, que solo se aplica a las rutas '/api/ '. Esto permite a un atacante sondear el endpoint en busca de tokens de restablecimiento válidos sin ninguna limitación de solicitudes por IP, conteo de intentos o mecanismo de bloqueo. El endpoint actúa como un oráculo, devolviendo una respuesta distinguible para tokens válidos frente a inválidos (HTTP 200 vs redirección HTTP 302). Un atacante puede enviar un número ilimitado de intentos de tokens al endpoint de confirmación de restablecimiento de contraseña sin que se aplique ninguna limitación. Sin embargo, la explotabilidad práctica se mitiga significativamente por la generación actual de tokens, que utiliza 'hash( sha256 , random_bytes(32))', proporcionando 256 bits de entropía. Los tokens también caducan después de 15 minutos y se eliminan después de un uso exitoso. La misma brecha arquitectónica se aplica a otras rutas de autenticación servidas por el controlador, incluyendo '/staff/email/:hash' (confirmación de restablecimiento de contraseña de administrador) y '/client/confirm-email/:hash' (confirmación de correo electrónico). La versión 0.8.0 soluciona el problema. Hay algunas soluciones alternativas disponibles. Configure un proxy inverso (por ejemplo, Nginx, Apache, Cloudflare) para aplicar la limitación de velocidad por IP a las rutas '/client/reset-password-confirm/ ' y '/staff/email/ ' y/o utilice una regla de WAF para limitar las tasas de solicitud a estos endpoints. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'FOSSBilling', 'product': 'FOSSBilling', 'versions': [{'status': 'affected', 'version': '< 0.8.0'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-43926', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-04T14:36:26.942114Z'} -
New CVE Received by [email protected]
Jun. 04, 2026
Action Type Old Value New Value Added Description FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to `/api/*` routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). An attacker can submit unlimited token guesses to the password reset confirmation endpoint with no throttling applied. However, practical exploitability is significantly mitigated by the current token generation, which uses `hash('sha256', random_bytes(32))`, providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including `/staff/email/:hash` (admin password reset confirmation) and `/client/confirm-email/:hash` (email confirmation). Version 0.8.0 fixes the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password-confirm/*` and `/staff/email/*` paths and/or use a WAF rule to limit request rates to these endpoints. Added CVSS V4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-204 Added CWE CWE-307 Added Reference https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0 Added Reference https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-cqqm-p3x5-9fqg