CVE-2026-108109: Hotspotbilling Phpnuxbill

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

Affected products

• Hotspotbilling Phpnuxbill: up to and including 2025.3.20

Published 2026-10-09. Last modified 2026-10-09.