Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to `/ipn.php` at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.
Published: 2026-07-06
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

HTTP request to the /ipn.php endpoint in FOSSBilling when the Custom payment adapter is enabled. The request is accepted as a legitimate payment notification, causing the system to mark any unpaid invoice as paid and credit the associated client account, all without any real payment occurring. The flaw is an example of missing authentication (CWE-306) and forgery of information (CWE-346).

Affected Systems

FOSSBilling versions 0.6.0 through 0.7.2 are vulnerable. Version 0.8.0 contains the patch that fixes the issue. The vulnerability is only exploitable when the Custom payment adapter is active and the /ipn.php endpoint is publicly reachable from the internet.

Risk and Exploitability

The CVSS score of 9.2 classifies the issue as critical. The EPSS score of < 1% indicates a low overall exploitation probability, and the vulnerability is not listed in the CISA KEV catalog to the exposed /ipn.php endpoint, making the attack path straightforward for an unauthenticated adversary.

Generated by OpenCVE AI on July 26, 2026 at 20:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FOSSBilling to version 0.8.0 or later
  • If the Custom payment gateway is not needed, disable it
  • Restrict access to /ipn.php at the web‑server level (e.g., via IP allowlisting) to prevent unauthorized callbacks
  • Monitor /ipn.php logs for anomalous or unauthorized requests

Generated by OpenCVE AI on July 26, 2026 at 20:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Fossbilling
Fossbilling fossbilling
Vendors & Products Fossbilling
Fossbilling fossbilling

Mon, 06 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to `/ipn.php` at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.
Title FOSSBilling has an unauthenticated payment bypass via IPN callback forgery
Weaknesses CWE-306
CWE-346
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N'}

Subscriptions

Fossbilling Fossbilling
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-07T15:15:36.538Z

Reserved: 2026-04-26T13:26:14.514Z

Link: CVE-2026-42341

cve-icon Vulnrichment

Updated: 2026-07-07T15:15:33.318Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T20:15:04Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function

  • CWE-346

    Origin Validation Error