CVE-2026-53646

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.5.6 through 0.7.2

Description When a ClientPasswordReset record already exists for a client from a previous unexpired request, subsequent calls to the reset password guest API endpoint reuse the existing token instead of generating a new one. The 15-minute validity window is based on the created at timestamp of the first request rather than the most recent email. This allows an attacker who obtained the original reset link to use it even after the victim requests a new reset, as the original token is not invalidated or rotated.

Recommendations Update to version 0.8.0. Configure a reverse proxy to apply per-IP rate limiting to the /client/reset-password endpoint. Manually clear expired client password reset records from the database after a client reports a suspected compromise.