A high-severity flaw in the FOSSBilling password recovery workflow allows remote, unauthenticated attackers to compromise accounts, posing a significant risk to user data.

This is a weak password recovery mechanism (CWE-640) where the implementation fails to securely manage the forgotten password process, allowing unauthorized access without prior authentication.

The vulnerability carries a CVSS score of 7.7, representing a critical risk to client management systems. Successful exploitation could lead to full account takeover, exposing sensitive billing and client data, and potentially facilitating downstream fraud or system-wide compromise.

Immediate Action: Upgrade all instances of FOSSBilling to version 0.8.0 or later immediately to resolve the vulnerable password reset logic.

Proactive Monitoring: Monitor authentication logs for anomalous password reset requests or spikes in account recovery activity.

Compensating Controls: If an immediate upgrade is not possible, disable the self-service password recovery feature or implement strict IP-based rate limiting on the recovery endpoint.

Public Exploit Available: false

The password recovery mechanism is a high-value target for attackers. Given that this vulnerability allows for unauthenticated access, upgrading to the patched version is the only effective way to ensure the integrity of your user accounts and billing data.