FOSSBilling, a free and open-source billing and client-management system, contains a flaw in its client password-reset flow (CWE-640). In vulnerable releases 0.5.6 through 0.7.2, when a reset request is made and a ClientPasswordReset record already exists for a client, the application reuses that existing token instead of generating a new one. The 15‑minute validity window is anchored to the original request’s created_at timestamp, not the time of the most recent email. An attacker who obtains the initial reset link can therefore continue to use that token to reset the account password even after the victim requests a new password reset, because the original token is never invalidated or rotated. The issue is fixed in version 0.8.0, and administrators can mitigate by configuring a reverse proxy such as Nginx, Apache, or Cloudflare to apply per‑IP rate limiting on the /client/reset-password endpoint, or by manually deleting expired client_password_reset records from the database after a suspected compromise.

The open-source billing platform FOSSBilling is affected. Vulnerable releases are 0.5.6 through 0.7.2; version 0.8.0 includes the fix that invalidates obsolete tokens.

The CVSS score of 7.7 denotes high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only access to the publicly exposed /client/reset-password endpoint; an attacker can repeatedly submit reset requests and, if he obtains the initial reset link, he can use it until the 15‑minute window lapses. No privileged system access is needed for this attack.