CVE-2026-108109

Name of the Vulnerable Software and Affected Versions PHPNuxBill versions prior to 2025.3.21

Description An account takeover issue exists in the customer password reset flow within the 'system/controllers/forgot.php' endpoint. Unauthenticated attackers who know a customer username can brute-force the 6-digit otp code because the system lacks attempt limits or lockout mechanisms. Upon successfully guessing the code, the attacker can retrieve the newly set password directly from the HTTP response to hijack the account.

Recommendations Update PHPNuxBill to version 2025.3.21 or later.