CVE-2026-112374

Name of the Vulnerable Software and Affected Versions FOSSBilling versions prior to 0.8.9

Description A Cross-Site Request Forgery (CSRF) issue exists in the staff guest login endpoint 'POST /api/guest/staff/login'. This occurs because the checkGuestClientAuthentication() function only allowlists client login and client create, leaving staff login without CSRF or Origin validation. A remote attacker can use an auto-submitting HTML form with controlled credentials to silently authenticate a victim's browser into the attacker's staff account.

Recommendations Update FOSSBilling to version 0.8.9 or later. As a temporary mitigation, restrict access to the 'POST /api/guest/staff/login' endpoint.