CVE-2026-112374

CVSS 5.1 (medium) · published 2026-10-30

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists client_login and client_create, leaving staff_login without CSRF or Origin validation. Attackers can host an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.

Weakness: CWE-352

Source: NVD CVE-2026-112374

References

• https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-h7w3-wp25-gf86
• https://www.vulncheck.com/advisories/fossbilling-before-login-csrf-via-staff-guest-login-api

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.