CVE-2026-42341

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.6.0 through 0.7.2

Description An unauthenticated payment bypass exists in the IPN callback endpoint /ipn.php. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment by sending a single crafted HTTP request.

Recommendations Update to version 0.8.0. Disable the Custom payment gateway if not actively needed. Restrict access to the /ipn.php endpoint at the web server level using IP allowlisting.