CVE-2026-53646— FOSSBilling 授权问题漏洞

FOSSBilling: Client password reset token reuse allows persistent account takeover

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already exists for a client (from a previous unexpired reset request), subsequent calls to the `reset_password` guest API endpoint reuse the existing token instead of generating a new one. The 15-minute validity window is anchored to the first request's `created_at` timestamp, not the time of the most recent email. An attacker who obtained the original reset link remains able to use it even after the victim requests a new reset, because the original token is never invalidated or rotated. Version 0.8.0 patches the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password` endpoint to minimize the window of opportunity, and/or manually clear expired `client_password_reset` records from the database after a client reports a suspected compromise.

N/A

忘记口令恢复机制弱

FOSSBilling 授权问题漏洞

fossbilling是fossbilling团队开源的一种高效计费和客户管理方案。 FOSSBilling 0.5.6版本至0.7.2版本存在授权问题漏洞，该漏洞源于密码重置令牌重用问题，当客户端存在未过期的重置请求记录时，后续重置调用会重用现有令牌且原始令牌未失效，攻击者获取原始重置链接后可在受害者申请新重置后仍可继续使用。

N/A

N/A