CVE-2026-42341

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to `/ipn.php` at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.

• CWE-306
• CWE-346

• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-5493-9m76-2qrr

Published

Jul 6, 2026

Last Modified

Jul 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42335MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-42336MaxKB is an open-source AI assistant for enterprise. MaxKB 2…5.1
• CVE-2026-42337MaxKB is an open-source AI assistant for enterprise. MaxKB 2…5.3
• CVE-2026-42338ip-address is a library for parsing and manipulating IPv4 an…6.1
• CVE-2026-42339New API is a large language mode (LLM) gateway and artificia…7.1
• CVE-2026-4234A security flaw has been discovered in SSCMS 7.4.0. This vul…6.3
• CVE-2026-42342React Router is a router for React. In versions 7.0.0 throug…7.5
• CVE-2026-42343FastGPT is an AI Agent building platform. In versions 4.14.1…6.3
• CVE-2026-42344FastGPT is an AI Agent building platform. In versions 4.14.1…6.3
• CVE-2026-42345FastGPT is an AI Agent building platform. In versions 4.14.1…7.7
• CVE-2026-42346Postiz is an AI social media scheduling tool. From version 2…6.5
• CVE-2026-42347Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…