Description
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hotspotbilling | phpnuxbill | ≤ 2025.3.20 | — |
References
- GitHub Security Advisory (GHSA-337r-rrrc-r559) vendor-advisory
- Patch Commit patch
- https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/controllers/forgot.php#L41 technical-description
- https://github.com/hotspotbilling/phpnuxbill product
- VulnCheck Advisory: PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code third-party-advisory