CVE-2026-112374: FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists clientlogin and clientcreate, leaving stafflogin without CSRF or Origin validation. Attackers can host an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any user whose browser can be induced to submit a request to an affected FOSSBilling instance is exposed. Exploitation requires user interaction, such as visiting an attacker-controlled page.
What does an attacker need to exploit it?
The attacker does not need prior privileges. They need to host or deliver an auto-submitting HTML form that sends attacker-controlled staff credentials to POST /api/guest/staff/login.
What is the impact of successful exploitation?
The victim's browser can be silently authenticated into the attacker's staff account. The reported impact is integrity-related rather than confidentiality or availability-related.
Which versions are affected?
FOSSBilling versions before 0.8.9 are affected. Version 0.8.9 is identified in the provided release reference.