Vulnerability · Published Jul 6, 2026 · Assigned by GitHub_M
CVE-2026-42341FOSSBilling has an unauthenticated payment bypass via IPN callback forgery
Critical 9.2
In plain English
A critical-severity missing authentication in FOSSBilling from FOSSBilling. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to `/ipn.php` at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FOSSBilling | FOSSBilling | >= 0.6.0, < 0.8.0 |
Weakness: CWE-306, CWE-346 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N