CVE-2026-43926 FOSSBilling's password reset confirmation endpoint lacks rate limiting
Attackers can bypass rate limits on password reset endpoints to brute-force tokens, though high entropy mitigates practical success.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-43926?
CVE-2026-43926 is a medium-severity missing authorization vulnerability in FOSSBilling, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-password-confirm/:hash` is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to `/api/*` routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). An attacker can submit unlimited token guesses to the password reset confirmation endpoint with no throttling applied. However, practical exploitability is significantly mitigated by the current token generation, which uses `hash('sha256', random_bytes(32))`, providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including `/staff/email/:hash` (admin password reset confirmation) and `/client/confirm-email/:hash` (email confirmation). Version 0.8.0 fixes the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password-confirm/*` and `/staff/email/*` paths and/or use a WAF rule to limit request rates to these endpoints.
Which versions are affected by CVE-2026-43926?
How do I fix CVE-2026-43926?
No fix has been published for CVE-2026-43926 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-43926 being exploited?
There is no known exploitation of CVE-2026-43926 in the wild and no public exploit code.
Sources
Also known as GHSA-cqqm-p3x5-9fqg.