CVE-2026-53644

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.5.3 through 0.7.2

Description Authenticated clients can read and reset API key service secrets for orders that are not in an active state, such as suspended or canceled. This occurs due to missing order-state validation in the /api/client/order/service and /api/client/serviceapikey/reset API endpoints, even though the Serviceapikey module contains an isActive() helper and the frontend UI restricts access based on the order.status variable.

Recommendations Update to version 0.8.0. Uninstall the Serviceapikey module if it is not required to remove the affected endpoints. Use a reverse proxy or WAF to restrict access to the /api/client/order/service and /api/client/serviceapikey/reset endpoints based on application-level order-state logic.