CVE-2026-108109
CRITICAL
CVSS 9.1
Published: 2026-10-09
Modified: 2026-10-09
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
Quick Facts
| CVE ID | CVE-2026-108109 |
| CVSS Score | 9.1 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| Published | 2026-10-09 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/hotspotbilling/phpnuxbill
- https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/…
- https://github.com/hotspotbilling/phpnuxbill/commit/c3c2a92d…
- https://github.com/hotspotbilling/phpnuxbill/security/adviso…
- https://www.vulncheck.com/advisories/phpnuxbill-through-2025…
- https://github.com/hotspotbilling/phpnuxbill/security/adviso…