CVE-2026-43928 Overview
CVE-2026-43928 affects FOSSBilling, a free, open-source billing and client management system. The vulnerability exists in the PayPalEmail payment adapter, which accepts PayPal Instant Payment Notification (IPN) callbacks and credits the IPN-supplied mc_gross amount to the client's balance without validating it against the invoice total. A $0.05 floating-point epsilon tolerance in the invoice credit-payment logic compounds the issue. A client can underpay an invoice by up to $0.04 and still have the invoice marked as fully paid. FOSSBilling version 0.8.0 patches the flaw.
Critical Impact
Merchants using the PayPalEmail adapter can experience minor financial loss as attackers mark invoices paid while underpaying by up to $0.04 per transaction.
Affected Products
- FOSSBilling versions prior to 0.8.0
- FOSSBilling deployments using the PayPalEmail payment adapter
- Merchant environments processing PayPal IPN callbacks
Discovery Timeline
- 2026-07-06 - CVE-2026-43928 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-43928
Vulnerability Analysis
The vulnerability [CWE-754] stems from improper checking for unusual or exceptional conditions in the FOSSBilling PayPal IPN handler. The PayPalEmail adapter trusts the mc_gross value provided in the IPN callback and credits it directly to the client's balance. The adapter never compares this value against the invoice total before marking the invoice as paid.
A secondary defect amplifies the impact. FOSSBilling's invoice credit-payment logic uses a $0.05 floating-point epsilon tolerance when determining whether an invoice is fully paid. This tolerance permits a shortfall of up to $0.04 per invoice to still trigger a paid status.
Root Cause
The root cause is missing server-side validation of payment amounts against the corresponding invoice total. The adapter follows an implicit trust model for IPN payloads. The epsilon tolerance in the credit-payment comparison was likely introduced to accommodate floating-point rounding but functions as a business logic bypass.
Attack Vector
An authenticated client with an outstanding invoice initiates a PayPal payment for slightly less than the invoice total. When the IPN callback arrives, FOSSBilling credits the underpaid amount to the client's balance. Because the shortfall falls within the $0.05 epsilon tolerance, the system marks the invoice fully paid. The attack requires network access and low privileges but yields only limited financial impact per invoice. See the FOSSBilling GitHub Security Advisory for full technical details.
Detection Methods for CVE-2026-43928
Indicators of Compromise
- IPN transactions where the mc_gross value does not exactly match the corresponding invoice total
- Invoices marked as paid with a remaining balance between $0.01 and $0.04
- Repeated PayPal payments from the same client with consistent minor shortfalls
Detection Strategies
- Query the invoices table for records marked paid where paid_amount is less than invoice_total
- Reconcile PayPal transaction reports against FOSSBilling invoice records to identify amount mismatches
- Alert on IPN payloads containing non-standard mc_gross values relative to expected invoice amounts
Monitoring Recommendations
- Enable logging of all IPN callbacks including the raw mc_gross, invoice, and payer_email fields
- Configure daily reconciliation reports comparing PayPal settlement totals against FOSSBilling invoice statuses
- Review historical transactions since the deployment of the PayPalEmail adapter for underpayment patterns
How to Mitigate CVE-2026-43928
Immediate Actions Required
- Upgrade FOSSBilling to version 0.8.0 or later, which patches the IPN validation flaw
- Audit historical IPN transactions for mc_gross values that do not match invoice totals
- Manually review and refund suspicious PayPal payments identified during the audit
Patch Information
FOSSBilling version 0.8.0 addresses CVE-2026-43928 by validating the IPN-supplied amount against the invoice total before crediting the client's balance. Administrators should apply the upgrade following the guidance in the FOSSBilling GitHub Security Advisory.
Workarounds
- No effective workaround exists without modifying the source code of the PayPalEmail adapter
- Merchants unable to upgrade immediately should monitor IPN transactions for amount mismatches against invoice totals
- Consider temporarily disabling the PayPalEmail adapter and switching to a payment method with stricter validation until the patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
