A critical session management vulnerability in FOSSBilling permits the persistence of unauthorized access due to insufficient session expiration controls.

The application fails to properly expire sessions (CWE-613), allowing an authenticated attacker or a malicious actor who has hijacked a session to maintain access longer than intended. This flaw effectively bypasses standard security logout procedures.

With a CVSS score of 8.7, this vulnerability presents a high risk for unauthorized account takeover and long-term persistence in the system. The inability to reliably terminate sessions means that compromised accounts remain vulnerable until manually invalidated or purged by administrators, increasing the likelihood of unauthorized data access and fraudulent billing transactions.

Immediate Action: Update the FOSSBilling installation to version 0.8.0 or later to ensure robust session lifecycle management.

Proactive Monitoring: Monitor for active sessions that persist beyond expected timeframes and inspect logs for concurrent or anomalous login activity from suspicious IP addresses.

Compensating Controls: Enforce short session timeouts and require re-authentication for sensitive operations to mitigate the window of opportunity for session-based attacks.

Public Exploit Available: false

Maintaining secure session management is fundamental to platform security. Administrators must treat this as a high-priority update to prevent session hijacking and unauthorized persistence. Applying the 0.8.0 patch is the only definitive way to resolve the underlying session expiration defect.