CVE-2026-43924: FOSSBilling Open Redirect Vulnerability

CVE-2026-43924 Overview

CVE-2026-43924 is an open redirect vulnerability in FOSSBilling, a free, open-source billing and client management system. Versions prior to 0.8.0 fail to validate the URL scheme of administrator-configured destination URLs in the Redirect module. Attackers with administrator access can configure arbitrary external URLs as redirect targets, enabling phishing campaigns that leverage trusted FOSSBilling domains. The redirect is issued as an HTTP 301 Moved Permanently response, which browsers cache persistently and amplify across sessions. Exploitation requires administrator privileges, limiting practical attack scenarios to multi-admin environments or compromised admin accounts. Version 0.8.0 resolves the issue.

Critical Impact
Authenticated administrators can configure arbitrary external redirect targets, enabling persistent phishing redirects from trusted FOSSBilling URLs through cached 301 responses.

Affected Products

FOSSBilling versions prior to 0.8.0
FOSSBilling Redirect module (mod_redirect)
Self-hosted FOSSBilling deployments with multi-admin configurations

Discovery Timeline

2026-06-03 - CVE-2026-43924 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-43924

Vulnerability Analysis

The vulnerability is classified under [CWE-601] URL Redirection to Untrusted Site (Open Redirect). The Redirect module accepts destination URLs configured by administrators without validating the URL scheme or host against an allowlist. Any string supplied as a target is stored in the database and later used to construct an HTTP redirect response. When a user requests a legitimate FOSSBilling URL mapped to a redirect entry, the server issues an HTTP 301 Moved Permanently response pointing to the attacker-controlled destination. Browsers cache 301 responses aggressively, meaning the malicious redirect persists for affected users even after the database entry is corrected.

Root Cause

The root cause is missing input validation on the redirect target URL stored in the extension_meta table where extension = 'mod_redirect'. The module does not enforce scheme restrictions (such as limiting redirects to https:// paths on the same origin) and does not validate destination hosts against an allowlist of trusted domains.

Attack Vector

An attacker with administrator privileges, or one who has compromised an administrator account, creates or modifies a redirect entry pointing to an external phishing site. Victims clicking what appears to be a legitimate FOSSBilling URL receive a 301 response and are silently navigated to the attacker-controlled site. The cached redirect persists in victim browsers, enabling repeated exploitation without further server-side action. Practical attack scenarios are limited to multi-admin environments or post-compromise admin account abuse.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-v8rf-g37v-vgpx for technical details.

Detection Methods for CVE-2026-43924

Indicators of Compromise

Entries in the extension_meta table with extension = 'mod_redirect' containing external or unexpected target URLs
HTTP 301 Moved Permanently responses from FOSSBilling endpoints pointing to domains outside the FOSSBilling host
User reports of unexpected redirection from legitimate FOSSBilling URLs to unfamiliar sites

Detection Strategies

Audit the extension_meta table periodically and flag any redirect target URLs that do not match the expected internal domain
Inspect web server access logs for outbound 301 responses with Location headers referencing untrusted external hosts
Correlate administrator login events with subsequent modifications to redirect entries to identify suspicious configuration changes

Monitoring Recommendations

Monitor administrative actions on the Redirect module and alert on creation or modification of redirect entries
Track HTTP response codes and Location header values served by FOSSBilling for anomalies
Enable database audit logging on the extension_meta table to capture configuration changes with attribution

How to Mitigate CVE-2026-43924

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, which validates the URL scheme of redirect destinations
Audit all existing entries in the extension_meta table where extension = 'mod_redirect' and remove any entries targeting external or unexpected URLs
Review administrator account access and rotate credentials for any account suspected of compromise

Patch Information

The fix is included in FOSSBilling 0.8.0. Refer to the GitHub Release Note 0.8.0 and the GitHub Security Advisory GHSA-v8rf-g37v-vgpx for full details on the patch and affected components.

Workarounds

Restrict access to the Redirect module to a minimal set of trusted administrators only
Audit existing redirect entries in the extension_meta table with extension = 'mod_redirect' for unexpected or external target URLs and remove suspicious entries
Instruct users to clear browser caches if a malicious 301 redirect has been served, since 301 responses are cached persistently

bash

# Example audit query for redirect entries
SELECT id, meta_key, meta_value
FROM extension_meta
WHERE extension = 'mod_redirect';