CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

EUVD-2026-87685

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

EUVD-2026-87686

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page e.g. /customerindex.php?page=2fa&action=delete, with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers...

CVE-2026-100712

The froxlor software (versions through 2.3.10 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack that disables a user's two-factor authentication (2FA) . The root cause is that the 2FA management page (e.g., /customer_index.php?page=2fa&action=delete) responds to unauthenticated-trigge...

CVE-2026-100713

Froxlor versions 2.3.10 and earlier are vulnerable to a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php ). The flaw exists because symlink validation occurs only at check time, while the filesystem path is re-resolved as r...

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

EUVD-2026-87684

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100711

Versions of froxlor prior to 2.3.12 are vulnerable to an authentication bypass because they fail to invalidate panel sessions , API keys , and 2FA trust cookies upon a user password change. This flaw allows attackers who have hijacked a session, obtained a valid API key, or possess a 2FA trust to...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response...

CVE-2026-100710

Froxlor versions through 2.3.10 are vulnerable to a sensitive data exposure issue because the application fails to filter specific columns from API responses. Specifically, the functions Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a...

CVE-2026-100710 Froxlor before 2.3.12 DKIM Private Key Disclosure via API

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get, Domains::listing, SubDomains::get, and the admin branch of SubDomains::listing perform a wildcard SELECT over the paneldomains table and return the row unmodified, including the paneldomains.dkimprivkey...

CVE-2026-100710 Froxlor before 2.3.12 DKIM Private Key Disclosure via API

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get, Domains::listing, SubDomains::get, and the admin branch of SubDomains::listing perform a wildcard SELECT over the paneldomains table and return the row unmodified, including the paneldomains.dkimprivkey...

EUVD-2026-87683

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get, Domains::listing, SubDomains::get, and the admin branch of SubDomains::listing perform a wildcard SELECT over the paneldomains table and return the row unmodified, including the paneldomains.dkimprivkey...

CVE-2026-100710 Froxlor before 2.3.12 DKIM Private Key Disclosure via API

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get, Domains::listing, SubDomains::get, and the admin branch of SubDomains::listing perform a wildcard SELECT over the paneldomains table and return the row unmodified, including the paneldomains.dkimprivkey...

CVE-2026-100709 Froxlor before 2.3.12 2FA Bypass via Namespace Confusion

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens panel2fatokens without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated...

CVE-2026-100708

Froxlor versions before 2.3.13 are vulnerable to private key disclosure via the Certificates.get and Certificates.listing API commands. The root cause is that the results of underlying domain_ssl_settings queries are processed by ApiCommand::response() without any field stripping or allowlist, ca...