NVD CRITICAL: CVE-2026-108109 — PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the c...

Friday, October 9, 2026 at 03:17 PM UTC·Source: NIST NVD

Updated: Friday, October 9, 2026 at 04:00 PM UTC

Executive Summary

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-108109

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 9, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Indian tech company eMudhra announces withdrawal from certificate business after security incident

The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.

1h agoThe Record

MEDIUMVulnerability

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its

1h agoThe Hacker News

CRITICALVulnerability

I had plans for that second

The Earth is speeding up, the leap second is being abolished, oh, and there's critical vulnerabilities in PHP.

1h agoCisco Talos