Live › vulnerability › CVE-2026-112374
FOSSBilling before 0.8.9 accepts staff login requests at POST /api/guest/staff/login without CSRF or Origin checks. A malicious page can auto-submit a form that silently logs a visitor's browser into an attacker-controlled staff account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Any FOSSBilling installation older than 0.8.9 that exposes its staff login endpoint to the internet. The risk is a staff member's browser being logged into an attacker's account after they visit a malicious page. Instances where the staff login endpoint is not reachable from the internet are less exposed.
No product ranges from the sources yet.
0.8.9./api/guest/staff/login in the deployed code or web server logs.0.8.9 or later, per the NVD description.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists client_login and client_create, leaving staff_login without CSRF or Origin validation. Attackers can host an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.
This page as .md · .json · in your agent: get_signal("CVE-2026-112374")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.