CVE-2026-100711 — froxlor before 2.3.12 Authentication Bypass via Session Persistence
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, …
Published: 2026-09-26 · CVSS: 8.7 · CVSS 4.0
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7