The vulnerability in PHPNuxBill allows an unauthenticated attacker to guess a six‑digit OTP code used for password resets. No attempt limits or lockout mechanisms exist in the forgot.php controller, so the attacker can brute‑force the code and read the newly set password from the HTTP response, effectively hijacking the user’s account. This flaw is a classic case of password guessing (CWE-307).

PHPNuxBill up to and including version 2025.3.20 is affected. The vulnerability resides in the password reset functionality of system/controllers/forgot.php and results in full account takeover for any user whose username is known to the attacker.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. Although an EPSS score is not available, the lack of rate limiting in the OTP process makes exploitation straightforward for attackers with network access to the web interface. The issue is not listed in CISA’s KEV catalog, but the high severity and ease of exploitation make it a significant risk, especially to systems that lack additional monitoring or rate‑limiting controls.