CVE-2026-108109: Improper Restriction of Excessive Authentication Attempts in hotspotbilling phpnuxbill

The vulnerability exists in the system/controllers/forgot.php component of PHPNuxBill through version 2025.3.20. It involves improper restriction of excessive authentication attempts during the password reset process, specifically allowing brute-force attacks on the 6-digit otp_code. There are no rate limiting or lockout mechanisms, enabling attackers to repeatedly guess the OTP code. Successful exploitation allows reading the newly set password directly from the HTTP response, resulting in account takeover without requiring prior authentication.

An attacker can hijack any customer account by brute forcing the OTP code during password reset, leading to unauthorized access and potential full control over the victim's account. This compromises confidentiality and integrity of user accounts in PHPNuxBill instances running affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement manual rate limiting or lockout mechanisms on OTP verification attempts and avoid exposing sensitive information such as the new password in HTTP responses.