CVE-2026-42341: FOSSBilling has an unauthenticated payment bypass via IPN callback forgery
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to /ipn.php at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.0 - Configuration
Disable the Custom payment gateway adapter if it is not actively needed. (In v0.6.0 through v0.7.2, the vulnerability can be exploited when this adapter is enabled.)
FOSSBilling Custom payment gateway adapter Custom payment gateway enabled = false - Compensating control
Restrict access to the IPN callback endpoint at the web server level by applying IP allowlisting for /ipn.php. Note: this may interfere with legitimate payment callback processing.
Event History
Frequently Asked Questions
What is the CVSS score of CVE-2026-42341?
The CVSS score of CVE-2026-42341 is 9.2, which classifies it as critical.
What vulnerability does CVE-2026-42341 describe?
CVE-2026-42341 describes an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint.
How can I mitigate CVE-2026-42341?
To mitigate CVE-2026-42341, ensure that you do not enable the Custom payment adapter unless a fix is available.
What versions of FOSSBilling are affected by CVE-2026-42341?
FOSSBilling versions 0.6.0 through 0.7.2 are affected by CVE-2026-42341.
Is authentication required to exploit CVE-2026-42341?
No, CVE-2026-42341 can be exploited without authentication.