PHPNuxBill OTP Vulnerability Permits Unlimited Guessing to Steal Passwords in Versions Up to 2025.3.20

The National Vulnerability Database recorded CVE-2026-108109 as a critical vulnerability in PHPNuxBill, a billing platform for internet service providers. This flaw exists in the customer password reset flow and allows unauthenticated attackers to take over accounts through brute-force attacks on one-time passcodes.

The vulnerability is rated 9.3 on the CVSS scale, which classifies it as critical. It stems from a lack of rate limiting or lockout mechanisms in the `system/controllers/forgot.php` file. Attackers can guess the 6-digit OTP code repeatedly without restriction, leading to successful account compromise.

How the exploit works

An attacker needs only a valid customer username to begin the attack. The system generates a 6-digit OTP code for password resets but does not limit the number of guesses. This allows automated tools to cycle through possible combinations until the correct code is found.

Once the correct OTP is guessed, the system processes the password reset. The newly set password is then returned in the HTTP response body. This exposure allows the attacker to immediately view the credentials and log in to the victim's account.

Affected versions and scope

PHPNuxBill versions up to and including 2025.3.20 are affected by this vulnerability. The National Vulnerability Database lists HotspotBilling as the vendor associated with the product. Any installation running these versions is exposed to unauthenticated account takeover attempts.

The flaw is categorized under CWE-307, which relates to incorrect default permissions or insufficient authentication controls. The absence of brute-force protection makes the password reset flow a high-risk entry point for attackers targeting customer accounts.

Our take on the response

No patch or fix has been confirmed yet for this vulnerability. Administrators should assume that any public-facing PHPNuxBill instance is at risk. Monitoring for unusual login activity or password reset requests is essential until a vendor update is released.

Security teams should review their access logs for signs of brute-force attempts on the forgot password endpoint. Identifying spikes in failed OTP submissions can help detect ongoing exploitation. Isolating affected systems may be necessary if active attacks are detected.

What to do and how to stay safe: PHPNuxBill

• Monitor authentication logs for high volumes of failed password reset attempts from single IP addresses.
• Implement network-level rate limiting on the `/forgot.php` endpoint to restrict request frequency.
• Review firewall rules to block traffic from known malicious sources targeting the reset flow.
• Alert customers to change their passwords once the vendor provides an update for CVE-2026-108109.

Step-by-step guide: Vulnerability Prioritization for Small Businesses

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-108109?

It is a critical vulnerability in PHPNuxBill that allows unauthenticated attackers to brute-force 6-digit OTP codes during password resets.

Which versions of PHPNuxBill are affected?

All versions of PHPNuxBill up to and including 2025.3.20 are affected by this account takeover flaw.

Is there a fix available for this vulnerability?

No fix has been confirmed yet. Users should monitor for vendor updates and implement defensive measures in the meantime.