CVE-2026-100709 Details
Description
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate namespaces, a remembered-2FA token legitimately issued to a customer with a given ID also matches an administrator with the same ID. An attacker who controls a customer account with a colliding ID, holds a valid remembered-2FA cookie for it, and already knows the target administrator's password can bypass the administrator's TOTP second factor and obtain an authenticated administrator session. This is a second-factor bypass only; it does not defeat password authentication. Fixed in 2.3.12.
A vulnerability in Froxlor versions through 2.3.10 allows for a bypass of the TOTP second-factor authentication for administrators. This issue arises because the application stores only numeric user IDs in remembered-2FA tokens without including the account namespace. During the login process, the token lookup does not differentiate between customer and administrator accounts, despite each having separate ID namespaces. As a result, a remembered-2FA token from a customer can inadvertently validate an administrator's login if the IDs collide. Exploitation requires control of a customer account with a matching ID, possession of a valid remembered-2FA cookie, and knowledge of the administrator's password.
Users are advised to update Froxlor to version 2.3.12 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-9fq7-9w8p-c3qh | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/froxlor-before-2.3.12-2fa-bypass-via-namespace-confusion | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Froxlor | <= 2.3.10 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | New CVE Received | [email protected] |