Is CVE-2026-108108 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108108?

CVE-2026-108108 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-108108

Description

PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.