The vulnerability lies in PHPNuxBill’s Radius CHAP verification routine. Password::chap_verify() incorrectly returns true when the supplied response does not match, allowing an attacker who knows a valid username to log in with any password. This flaw creates an authentication bypass that grants unauthorized network access and lets the attacker consume the victim’s assigned bandwidth plan or other services.

The flaw affects all PHPNuxBill deployments up to and including version 2025.3.20, provided by the vendor hotspotbilling. Any installation running PHPNuxBill 2025.3.20 or earlier is vulnerable.

The CVSS score of 7.1 indicates high severity. Attackers can abuse the flaw remotely via a RADIUS channel, contacting the server with a known username and a mismatched password to trigger the false success response. The exploit is simple and does not require special conditions beyond knowledge of a valid user name. The vulnerability is not listed in CISA’s KEV catalog and no EPSS value is available, but the potential for widespread exploitation remains if many users rely on CHAP authentication.