CVE-2026-112374
Deferred Deferred - Pending Action

CSRF in FOSSBilling Staff Guest Login

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists client_login and client_create, leaving staff_login without CSRF or Origin validation. Attackers can host an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-112374
EUVD
EUVD-2026-113897

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FOSSBilling FOSSBilling 0.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FOSSBilling before version 0.8.9 has a Cross-Site Request Forgery (CSRF) vulnerability in the staff guest login API endpoint. The function checkGuestClientAuthentication() only validates client_login and client_create actions, leaving staff_login without CSRF or Origin protection. Attackers can exploit this by hosting an auto-submitting HTML form with their credentials, forcing a victim's browser to silently log into the attacker's staff account.

Detection Guidance

Check FOSSBilling logs for unusual authentication attempts via POST /api/guest/staff/login. Monitor network traffic for auto-submitting HTML forms targeting this endpoint. Inspect browser developer tools for unexpected staff login requests.

Impact Analysis

An attacker could gain unauthorized access to your FOSSBilling staff account without your knowledge. This could allow them to view, modify, or delete sensitive data, manage payments, or perform administrative actions on your behalf. The attack requires you to visit a malicious website while logged into FOSSBilling.

Mitigation Strategies

Upgrade FOSSBilling to version 0.8.9 or later immediately. Ensure CSRF tokens are enforced for all guest login endpoints. Review and restrict staff account access logs for unauthorized logins.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart