CVE-2026-108108

EUVD-2026-95809
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 12.67%
Common Weakness Enumeration
References
https://github.com/hotspotbilling/phpnuxbill
https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/autoload/Password.php#L48
https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-6f62-x25v-9686
https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-chap-authentication-bypass-via-password-chap-verify