CVE-2026-42341: FOSSBilling has an unauthenticated payment bypass via IPN callback forgery

Vulnerability summary

CVE-2026-42341 is a critical (CVSS 9.2) vulnerability in fossbilling. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.5% of scored vulnerabilities.

Timeline

1. 06-07-2026
   PublishedVulnerability first disclosed.
2. 07-07-2026
   Last modifiedVulnerability information updated.

Description

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to `/ipn.php` at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-346Origin Validation ErrorThe product does not properly verify that the source of data or communication is valid.