CVE-2026-100711GHSA-57wv-g7m3-hmff
froxlor before 2.3.12 Authentication Bypass via Session Persistence
froxlor froxlor
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.3.12froxlorCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.
Text from CVE List
Affected versions 2
- froxloraffected: all versions before 2.3.12CVE List
- froxlorunaffected: 2.3.12CVE List