SZB-a2949866af
FOSSBilling before 0.8.9 has CSRF in staff guest login endpoint
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- FOSSBilling
- Product
- FOSSBilling
- First seen
Summary
The EUVD entry EUVD-2026-113897 describes a cross-site request forgery flaw in the staff guest login endpoint that lets remote attackers force authentication. The entry gives a CVSS v3.1 score of 5.1/10.
If you use FOSSBilling
Upgrade FOSSBilling to version 0.8.9 or later
Review staff login activity for unexpected sessions
What the sources say 1
· Mastodon: “FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint” Source