CVE-2026-42341

Received Received - Intake

Unauthenticated Payment Bypass in FOSSBilling

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: GitHub, Inc.

Description

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to `/ipn.php` at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-42341

Affected Vendors & Products

Vendor	Product	Version / Range
fossbilling	fossbilling	From 0.6.0 (inc) to 0.7.2 (inc)
fossbilling	fossbilling	0.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability exists in FOSSBilling versions 0.6.0 through 0.7.2 and involves an unauthenticated payment bypass in the IPN callback endpoint.

When the Custom payment adapter is enabled, an attacker can send a specially crafted HTTP request to mark any unpaid invoice as paid and credit the associated client account without actually making a payment.

This means the attacker can fraudulently manipulate the billing system to their advantage.

Version 0.8.0 of FOSSBilling fixes this issue.

Workarounds include disabling the Custom payment gateway if not needed or restricting access to the `/ipn.php` endpoint at the web server level, though this may affect legitimate payment processing.

Impact Analysis

This vulnerability can allow an attacker to fraudulently mark invoices as paid without making any actual payment.

As a result, the attacker can credit their client account or any targeted account, leading to financial loss for the billing system operator.

It undermines the integrity of the billing process and can cause revenue loss and trust issues with clients.

Mitigation Strategies

To mitigate this vulnerability immediately, you should disable the Custom payment gateway if it is not actively needed.

Additionally, restrict access to the `/ipn.php` endpoint at the web server level, for example by implementing IP allowlisting.

Note that restricting access to `/ipn.php` may interfere with legitimate payment callback processing.

Upgrading to version 0.8.0 of FOSSBilling, which patches this issue, is also recommended.

Hi! I’m here to help you understand CVE-2026-42341. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70