Güvenlik Danışarlıklarına Dön

Security Advisory: WHMCS Admin Password Reset Weak Token

A weak token generation flaw in WHMCS's admin password reset flow is fixed in this security release: predictable reset tokens put administrator accounts at takeover risk. Update WHMCS from the Admin Area and rotate admin credentials as a precaution.

High
WHMCS

Etkilenen Sürümler

WHMCS 8.9.0 and earlier

Yamalanmış Sürüm

WHMCS 8.10.1

Varsayılan Güncelleme Komutu

yum update -y

Düzeltme Komutları

All Systems

Back up /var/www/html/whmcs
Download the patched release
Run the upgrade wizard at /install/upgrade

SharedLicense lisansı altında bunun anlamı

Your SharedLicense license itself is not affected — this is a change in WHMCS software, not in licensing. Apply it on every affected server: update to the fixed release from the WHMCS Admin Area. Licenses keep working through updates; nothing needs re-issuing or re-activating.

What happened

Password reset flows are only as strong as the secrecy of their tokens. WHMCS‘s admin reset tokens were generated too predictably, so an attacker who could request a reset and predict the token could set a new administrator password — full control of the billing and provisioning platform.

Who is affected

WHMCS installations — which concentrate customer records, invoices and hosting account credentials in one internet-exposed system. Admin compromise there is about the worst single event a hosting business can have.

How to apply the fix

  • Update WHMCS to the fixed release from the Admin Area.
  • Rotate administrator passwords after updating.
  • Review admin accounts and recent password-reset requests in the logs.

For SharedLicense customers

Licensing is unaffected — this is WHMCS software. Given what a WHMCS holds, treat this update as priority even though the flaw is now patched.

Sıkça Sorulan Sorular

What was wrong with the reset tokens?
They were generated predictably, so a requested reset could be completed by guessing the token.
What should I do besides updating?
Rotate admin passwords and review recent reset requests in the WHMCS logs.
How is WHMCS updated?
From the WHMCS Admin Area — download and apply the fixed release per its update utility.

Referanslar

Güvenlik Danışarlıkları

İlgili Danışarlıklar

WHMCS 9.1.0 Security Update

2026-10-01

WHMCS CVE-2026-16272

2026-09-09 00:00:00

PayTR Module for WHMCS CVE-2026-16025

2026-09-08 00:00:00

Sisteminizi güvenlik açıkları açısından kontrol edin

Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.

Sisteminizi Kontrol Edin