CVE-2026-108108

Published 9 October 2026 · tracked since 10 October 2026

Description

PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP wit

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-108109 CRITICAL 9.1
• CVE-2026-108107 CRITICAL 9.8
• CVE-2026-107806
• CVE-2026-108101 HIGH 7.5
• CVE-2026-107804 MEDIUM 5.3
• CVE-2026-107805 HIGH 7.5
• CVE-2026-105278 CRITICAL 9.8
• CVE-2026-104081 HIGH 8.1
• CVE-2026-94067 HIGH 8.1
• CVE-2026-94064 HIGH 8.8

→ Open the live CVE board · all tools