CVE-2026-100712 Details
Description
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g. /customer_index.php?page=2fa&action=delete), with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers POST/PUT/PATCH/DELETE requests, and the session cookie is set to SameSite=Lax, so a cross-site top-level navigation (link click or redirect) carries the victim's session and silently clears type_2fa/data_2fa. Both the customer and admin 2FA handlers are affected. An attacker who lures a logged-in panel user into following a crafted link reduces that account to password-only authentication, which can be chained with a compromised password for account takeover. Fixed in 2.3.12.
A vulnerability in Froxlor versions through 2.3.10 allows for the immediate disabling of a user's two-factor authentication (2FA) through an unauthenticated GET request to the 2FA management page. This action is performed without any confirmation, re-authentication, or CSRF token. The global CSRF protection only applies to POST, PUT, PATCH, and DELETE requests. With the session cookie set to SameSite=Lax, a cross-site top-level navigation can carry the victim's session and silently remove 2FA, leaving the account reliant on password-only authentication. This vulnerability affects both customer and admin 2FA handlers.
Users are advised to update to Froxlor version 2.3.12 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-w582-7wqv-62mm | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/froxlor-before-2.3.12-two-factor-authentication-bypass-via-csrf | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| froxlor | <= 2.3.10 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | New CVE Received | [email protected] |