Vulnerability Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to `/ipn.php` at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-42341?
CVE-2026-42341 is a documented vulnerability. FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When ...
How severe is CVE-2026-42341?
CVSS scoring is not yet available for CVE-2026-42341. Check NVD for updates.
Is there a patch for CVE-2026-42341?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.