CVE-2026-53644 Overview
CVE-2026-53644 affects FOSSBilling, a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to read and reset API key service secrets tied to orders that are no longer in an active state, such as suspended or canceled orders. The flaw is an authorization defect classified under CWE-639: Authorization Bypass Through User-Controlled Key. Two client API endpoints skip order-state validation even though an isActive() helper already exists in the Serviceapikey module. Version 0.8.0 contains the fix.
Critical Impact
Authenticated clients can retrieve and rotate API key secrets for suspended or canceled orders, breaking service isolation and enabling continued abuse of decommissioned integrations.
Affected Products
- FOSSBilling version 0.5.3 through 0.7.2
- FOSSBilling Serviceapikey module
- Client API endpoints /api/client/order/service and /api/client/serviceapikey/reset
Discovery Timeline
- 2026-07-06 - CVE-2026-53644 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-53644
Vulnerability Analysis
The vulnerability resides in FOSSBilling's client-facing API surface for the Serviceapikey module. The module ships with an isActive() helper designed to verify that the underlying order is in the active state before exposing API key operations. The frontend UI honors this contract by gating access on order.status == 'active'. However, the backend endpoints /api/client/order/service and /api/client/serviceapikey/reset do not invoke this state check. An authenticated client can therefore read the current API key secret and issue a reset against orders that have been suspended or canceled. The gap allows continued access to service credentials after the business decision to terminate service has been recorded.
Root Cause
The root cause is missing order-state validation in two client API endpoints. The isActive() helper is available in the Serviceapikey module but is never called by the affected endpoints. Authorization relies solely on ownership of the order, not on the current lifecycle state. This is a classic broken access control pattern where server-side enforcement lags behind UI-level gating.
Attack Vector
An attacker requires an authenticated client account that owns at least one suspended or canceled order that previously provisioned an API key. The attacker sends a request to /api/client/order/service to disclose the existing secret, or to /api/client/serviceapikey/reset to rotate it to a value they control. No user interaction is required, and the endpoints are reachable over the network. The verified code examples for this issue are not published; refer to the FOSSBilling GitHub Security Advisory GHSA-qf6j-vq68-qmfh for full technical details.
Detection Methods for CVE-2026-53644
Indicators of Compromise
- HTTP requests to /api/client/order/service or /api/client/serviceapikey/reset referencing order identifiers whose stored state is suspended or canceled.
- API key rotation events on service records that have no corresponding active order in the FOSSBilling database.
- Reuse of API keys tied to canceled orders against downstream provisioned services after service termination.
Detection Strategies
- Correlate application logs from FOSSBilling with the orders table state column to flag any Serviceapikey read or reset event that does not match an active order.
- Alert on downstream service authentication using API keys whose parent order has been marked canceled or suspended in billing.
- Review web server access logs for unexpected volumes of requests to the two affected endpoints from a single client session.
Monitoring Recommendations
- Enable verbose audit logging on the Serviceapikey module and forward events to a centralized log platform.
- Track API key rotation frequency per client and per order to surface anomalies against historical baselines.
- Monitor for authenticated client sessions that access orders shortly after those orders transition out of the active state.
How to Mitigate CVE-2026-53644
Immediate Actions Required
- Upgrade FOSSBilling to version 0.8.0 or later, which enforces the isActive() check on both affected endpoints.
- Rotate all API key secrets associated with orders that are currently suspended or canceled and revoke any keys still trusted downstream.
- Audit access logs since deployment of any affected version for prior use of /api/client/order/service and /api/client/serviceapikey/reset against non-active orders.
Patch Information
FOSSBilling 0.8.0 contains the fix. The patched release adds server-side order-state validation to the two client API endpoints so that requests targeting non-active orders are rejected. See the FOSSBilling GitHub Security Advisory GHSA-qf6j-vq68-qmfh for the commit references and upgrade guidance.
Workarounds
- Uninstall the Serviceapikey module if it is not required, which removes the affected endpoints entirely.
- Place a reverse proxy or web application firewall (WAF) in front of FOSSBilling and restrict /api/client/order/service and /api/client/serviceapikey/reset based on application-level order-state logic.
- Terminate downstream trust for API keys immediately when an order transitions to suspended or canceled, so that any residual disclosure has no privilege value.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
