GHSA-h7w3-wp25-gf86: FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists clientlogin and clientcreate, leaving stafflogin without CSRF or Origin validation. Attackers can host an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.