FOSSBilling versions 0.5.6 through 0.7.2 contain a flaw in the client password‑reset flow (CWE‑640). When a reset request is made and a token already exists for the client, the application reuses that token instead of generating a new one. The 15‑minute validity window is anchored to the timestamp of the original request’s `created_at` field, not the time of the most recent email. An attacker who obtains the initial reset link can therefore continue to use that token to reset the account password even after the victim has requested a new password reset, because the original token is never invalidated or rotated. The issue is fixed in version 0.8.0. Until then, administrators can mitigate by configuring a reverse proxy such as Nginx, Apache, or Cloudflare to apply per‑IP rate limiting on the /client/reset-password endpoint, or by manually deleting expired client_password_reset records from the database after a suspected compromise.

The open‑source billing platform FOSSBilling is affected. Vulnerable releases are 0.5.6 through 0.7.2; version 0.8.0 includes the fix that invalidates obsolete tokens.

The CVSS score of 7.7 denotes high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only access to the publicly exposed /client/reset-password endpoint; an attacker can repeatedly submit reset requests and, if he obtains the initial reset link, he can use it until the 15‑minute window lapses. No privileged system access is needed for this attack.