Key points
- CVE-2026-108109 affects PHPNuxBill versions up to and including 2025.3.20.
- The vulnerability carries a CVSS 9.3 rating, classified as critical severity.
- Attackers can brute-force the six-digit OTP code without triggering lockouts.
Unauthenticated attackers can now hijack customer accounts in PHPNuxBill by exploiting a flaw in the password reset mechanism. The vulnerability, tracked as CVE-2026-108109, allows threat actors to bypass security controls without needing initial credentials. This issue impacts all PHPNuxBill installations running version 2025.3.20 or earlier.
The flaw resides in the system/controllers/forgot.php file, which handles customer password resets. According to the National Vulnerability Database, attackers can guess the six-digit one-time password code repeatedly. There are no attempt limits or account lockout mechanisms to stop this brute-force activity. Once the correct code is guessed, the attacker receives the newly set password in the HTTP response.
Context and Background
The vulnerability is categorized under CWE-307, which relates to incorrect default permissions. Security researchers have assigned a CVSS score of 9.3 to this issue, marking it as critical. The lack of rate limiting on the OTP verification step is the primary factor driving this high severity rating. This design oversight allows automated scripts to cycle through all possible six-digit combinations rapidly.
The exposure is significant because the attacker does not need to authenticate before starting the brute-force process. Knowing a valid customer username is the only prerequisite for launching this attack. The system then reveals the new password directly in the response body upon successful code entry.
Who Is Affected
PHPNuxBill, also known as HotspotBilling, is the affected product. Any organization using PHPNuxBill versions up to 2025.3.20 is vulnerable to this account takeover risk. The vulnerability affects the customer-facing password reset flow, meaning end-users are the direct targets. System administrators must verify their current version immediately to determine if their environment is exposed.
No vendor patch or official fix has been confirmed yet for CVE-2026-108109. Users should monitor official channels for updates. Until a fix is available, the risk remains active for all installations within the affected version range.
Next steps
Administrators should audit their PHPNuxBill versions to confirm if they are running 2025.3.20 or older. Reviewing server logs for repeated failed OTP attempts may help identify ongoing exploitation. Disabling the password reset feature temporarily could mitigate risk if no patch is available. Monitor for official statements from the PHPNuxBill development team regarding remediation.
Background: Threat actors
Threat actors range from criminal syndicates seeking profit to state-sponsored groups aiming for espionage. Each type uses distinct tactics, techniques and procedures (TTPs) driven by their goals. Knowing the difference helps you prioritize alerts and allocate security resources where they matter most.
Read the full guide: Types of Threat Actors: Motives, Methods, and Defense Strategies
What to do and how to stay safe: PHPNuxBill
- Verify the installed version of PHPNuxBill against the affected list to confirm exposure.
- Implement IP-based rate limiting on the password reset endpoint to slow brute-force attacks.
- Monitor server logs for unusual volumes of requests to the forgot.php controller.
- Consider disabling the self-service password reset feature until a vendor patch is released.
Step-by-step guide: Account Lockout Policies: Preventing Denial of Service Attacks
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108109?
The vulnerability has a CVSS score of 9.3, which is rated as critical severity.
Which PHPNuxBill versions are affected by this flaw?
All versions of PHPNuxBill up to and including 2025.3.20 are affected.
Does the attacker need a password to exploit this?
No, the attacker only needs to know a valid customer username to initiate the brute-force attack.
