PHPNuxBill Account Takeover via Password Reset OTP Brute-Force

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php.

Unauthenticated attackers who know a customer username can brute-force the 6-digit otp_code because there are no attempt limits or lockout.

• Affected versions: through 2025.3.20
• Precondition: attacker knows a customer username
• Impact: attacker can read the newly set password from the HTTP response and hijack the account