Critical Account Takeover Flaw Found in PHPNuxBill Password Reset Flow

A critical account takeover vulnerability has been identified in PHPNuxBill, a billing and automation platform, affecting all versions through 2025.3.20. The flaw, tracked as CVE-2026-108109, allows unauthenticated attackers to hijack customer accounts by exploiting weaknesses in the password reset process.

The vulnerability resides in the `system/controllers/forgot.php` file, which handles the customer password reset flow. According to the National Vulnerability Database (NVD) record, the issue is rated with a CVSS score of 9.3, classifying it as critical. The weakness stems from the absence of attempt limits or account lockout mechanisms when validating the one-time password (OTP) code.

An attacker who knows a valid customer username can repeatedly guess the 6-digit `otp_code`. Because there are no safeguards to prevent brute-force attacks, the attacker can eventually guess the correct code. Once the code is guessed, the system returns the newly set password in the HTTP response, allowing the attacker to immediately access the compromised account.

Technical Context and Risk

The vulnerability is categorized under CWE-307, which relates to improper restriction of excessive login attempts. In secure systems, password reset flows typically implement rate limiting, CAPTCHAs, or temporary account freezes after a certain number of failed attempts. PHPNuxBill lacks these controls in this specific component. The exposure is significant because the attack requires no authentication credentials other than the target’s username.

This lowers the barrier for entry for malicious actors, as usernames are often public or easily discoverable information in many business-to-consumer or business-to-business environments. The immediate return of the new password in the HTTP response further exacerbates the risk, providing the attacker with direct access without needing to intercept a separate notification channel like email or SMS.

Who Is Affected

This vulnerability impacts deployments of PHPNuxBill, which is also associated with the HotspotBilling product line. Any organization running PHPNuxBill versions up to 2025.3.20 is vulnerable. This includes service providers, internet service providers, and other businesses that use the platform for billing and customer management. Because the flaw allows for unauthenticated access, any exposed instance of the software is at risk regardless of whether the attacker has prior knowledge of the system's internal structure. The impact is direct account compromise, which can lead to data theft, service abuse, or further lateral movement within the victim's infrastructure.

What should you do?

No patch or fix has been confirmed yet by the vendor. Administrators should assume that any deployment of PHPNuxBill up to version 2025.3.20 is vulnerable. Immediate monitoring of the `system/controllers/forgot.php` endpoint for unusual traffic patterns is recommended. Organizations should restrict access to this endpoint via web application firewalls or IP allow-listing if possible, to limit exposure from external networks.