Auth bypass in Fossbilling
CVE-2026-53644
FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets for orders that are no longer in an `active` state (e.g., `sus…
Vulnerability class: IDOR (Insecure Direct Object Reference)
Affected products
- Fossbilling — versions >= 0.5.3, < 0.8.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)