CVE-2026-43926

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43926", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-04T16:59:09.089Z", "datePublished": "2026-06-04T12:46:30.909Z", "dateUpdated": "2026-06-04T14:37:01.297Z"}, "containers": {"cna": {"title": "FOSSBilling's password reset confirmation endpoint lacks rate limiting", "problemTypes": [{"descriptions": [{"cweId": "CWE-204", "lang": "en", "description": "CWE-204: Observable Response Discrepancy", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-307", "lang": "en", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-cqqm-p3x5-9fqg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-cqqm-p3x5-9fqg"}, {"name": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0"}], "affected": [{"vendor": "FOSSBilling", "product": "FOSSBilling", "versions": [{"version": "< 0.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-04T12:46:30.909Z"}, "descriptions": [{"lang": "en", "value": "FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to `/api/*` routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). An attacker can submit unlimited token guesses to the password reset confirmation endpoint with no throttling applied. However, practical exploitability is significantly mitigated by the current token generation, which uses `hash('sha256', random_bytes(32))`, providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including `/staff/email/:hash` (admin password reset confirmation) and `/client/confirm-email/:hash` (email confirmation). Version 0.8.0 fixes the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password-confirm/*` and `/staff/email/*` paths and/or use a WAF rule to limit request rates to these endpoints."}], "source": {"advisory": "GHSA-cqqm-p3x5-9fqg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T14:36:26.942114Z", "id": "CVE-2026-43926", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T14:37:01.297Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43926", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T14:36:26.942114Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T14:36:56.505Z"}}], "cna": {"title": "FOSSBilling's password reset confirmation endpoint lacks rate limiting", "source": {"advisory": "GHSA-cqqm-p3x5-9fqg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "FOSSBilling", "product": "FOSSBilling", "versions": [{"status": "affected", "version": "< 0.8.0"}]}], "references": [{"url": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-cqqm-p3x5-9fqg", "name": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-cqqm-p3x5-9fqg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0", "name": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to `/api/*` routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). An attacker can submit unlimited token guesses to the password reset confirmation endpoint with no throttling applied. However, practical exploitability is significantly mitigated by the current token generation, which uses `hash('sha256', random_bytes(32))`, providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including `/staff/email/:hash` (admin password reset confirmation) and `/client/confirm-email/:hash` (email confirmation). Version 0.8.0 fixes the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password-confirm/*` and `/staff/email/*` paths and/or use a WAF rule to limit request rates to these endpoints."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204: Observable Response Discrepancy"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-04T12:46:30.909Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43926", "state": "PUBLISHED", "dateUpdated": "2026-06-04T14:37:01.297Z", "dateReserved": "2026-05-04T16:59:09.089Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-04T12:46:30.909Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FOSSBilling", "vendor": "FOSSBilling", "versions": [{"status": "affected", "version": "< 0.8.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to `/api/*` routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). An attacker can submit unlimited token guesses to the password reset confirmation endpoint with no throttling applied. However, practical exploitability is significantly mitigated by the current token generation, which uses `hash('sha256', random_bytes(32))`, providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including `/staff/email/:hash` (admin password reset confirmation) and `/client/confirm-email/:hash` (email confirmation). Version 0.8.0 fixes the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password-confirm/*` and `/staff/email/*` paths and/or use a WAF rule to limit request rates to these endpoints."}, {"lang": "es", "value": "FOSSBilling es un sistema de gesti\u00f3n de facturaci\u00f3n y de clientes gratuito y de c\u00f3digo abierto. Antes de la versi\u00f3n 0.8.0, el endpoint de confirmaci\u00f3n de restablecimiento de contrase\u00f1a '/client/reset-password-confirm/:hash' es gestionado por un controlador que no es una API y no est\u00e1 cubierto por el limitador de velocidad de FOSSBilling, que solo se aplica a las rutas '/api/ '. Esto permite a un atacante sondear el endpoint en busca de tokens de restablecimiento v\u00e1lidos sin ninguna limitaci\u00f3n de solicitudes por IP, conteo de intentos o mecanismo de bloqueo. El endpoint act\u00faa como un or\u00e1culo, devolviendo una respuesta distinguible para tokens v\u00e1lidos frente a inv\u00e1lidos (HTTP 200 vs redirecci\u00f3n HTTP 302). Un atacante puede enviar un n\u00famero ilimitado de intentos de tokens al endpoint de confirmaci\u00f3n de restablecimiento de contrase\u00f1a sin que se aplique ninguna limitaci\u00f3n. Sin embargo, la explotabilidad pr\u00e1ctica se mitiga significativamente por la generaci\u00f3n actual de tokens, que utiliza 'hash( sha256 , random_bytes(32))', proporcionando 256 bits de entrop\u00eda. Los tokens tambi\u00e9n caducan despu\u00e9s de 15 minutos y se eliminan despu\u00e9s de un uso exitoso. La misma brecha arquitect\u00f3nica se aplica a otras rutas de autenticaci\u00f3n servidas por el controlador, incluyendo '/staff/email/:hash' (confirmaci\u00f3n de restablecimiento de contrase\u00f1a de administrador) y '/client/confirm-email/:hash' (confirmaci\u00f3n de correo electr\u00f3nico). La versi\u00f3n 0.8.0 soluciona el problema. Hay algunas soluciones alternativas disponibles. Configure un proxy inverso (por ejemplo, Nginx, Apache, Cloudflare) para aplicar la limitaci\u00f3n de velocidad por IP a las rutas '/client/reset-password-confirm/ ' y '/staff/email/ ' y/o utilice una regla de WAF para limitar las tasas de solicitud a estos endpoints."}], "id": "CVE-2026-43926", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43926", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T14:36:26.942114Z", "version": "2.0.3"}}]}, "published": "2026-06-04T14:16:41.193", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-cqqm-p3x5-9fqg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}, {"lang": "en", "value": "CWE-307"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FOSSBilling", "source": "cna", "vendor": "FOSSBilling"}, "product": "fossbilling", "vendor": "fossbilling"}], "created": "2026-06-04T15:00:15.008777+00:00", "updated": "2026-06-04T15:30:16.522657+00:00", "vendors": ["fossbilling", "fossbilling$PRODUCT$fossbilling"]}