Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate namespaces, a remembered-2FA token legitimately issued to a customer with a given ID also matches an administrator with the same ID. An attacker who controls a customer account with a colliding ID, holds a valid remembered-2FA cookie for it, and already knows the target administrator's password can bypass the administrator's TOTP second factor and obtain an authenticated administrator session. This is a second-factor bypass only; it does not defeat password authentication. Fixed in 2.3.12.
Froxlor before 2.3.12 2FA Bypass via Namespace Confusion
Problem type
Affected products
froxlor
< 2.3.12 - AFFECTED
2.3.12 - UNAFFECTED
References
https://github.com/froxlor/froxlor/security/advisories/GHSA-9fq7-9w8p-c3qh
https://www.vulncheck.com/advisories/froxlor-before-2.3.12-2fa-bypass-via-namespace-confusion
GitHub Security Advisories
GHSA-pj38-8h4x-w384
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens)...
https://github.com/advisories/GHSA-pj38-8h4x-w384Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate namespaces, a remembered-2FA token legitimately issued to a customer with a given ID also matches an administrator with the same ID. An attacker who controls a customer account with a colliding ID, holds a valid remembered-2FA cookie for it, and already knows the target administrator's password can bypass the administrator's TOTP second factor and obtain an authenticated administrator session. This is a second-factor bypass only; it does not defeat password authentication. Fixed in 2.3.12.
https://github.com/froxlor/froxlor/security/advisories/GHSA-9fq7-9w8p-c3qh
https://nvd.nist.gov/vuln/detail/CVE-2026-100709
https://www.vulncheck.com/advisories/froxlor-before-2.3.12-2fa-bypass-via-namespace-confusion
https://github.com/advisories/GHSA-pj38-8h4x-w384
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-100709Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-100709",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"dateUpdated": "2026-09-26T23:08:21.420Z",
"dateReserved": "2026-09-26T02:40:23.372Z",
"datePublished": "2026-09-26T13:24:02.908Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-09-26T13:24:02.908Z"
},
"datePublic": "2026-09-06T00:00:00.000Z",
"title": "Froxlor before 2.3.12 2FA Bypass via Namespace Confusion",
"descriptions": [
{
"lang": "en",
"value": "Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate namespaces, a remembered-2FA token legitimately issued to a customer with a given ID also matches an administrator with the same ID. An attacker who controls a customer account with a colliding ID, holds a valid remembered-2FA cookie for it, and already knows the target administrator's password can bypass the administrator's TOTP second factor and obtain an authenticated administrator session. This is a second-factor bypass only; it does not defeat password authentication. Fixed in 2.3.12."
}
],
"affected": [
{
"vendor": "froxlor",
"product": "froxlor",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.3.12"
},
{
"version": "2.3.12",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Improper Authentication",
"cweId": "CWE-287",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-9fq7-9w8p-c3qh",
"name": "GitHub Security Advisory (GHSA-9fq7-9w8p-c3qh)",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/froxlor-before-2.3.12-2fa-bypass-via-namespace-confusion",
"name": "VulnCheck Advisory: Froxlor before 2.3.12 2FA Bypass via Namespace Confusion",
"tags": [
"third-party-advisory"
]
}
],
"metrics": [
{
"format": "CVSS"
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"value": "RobinMoschini",
"type": "reporter"
}
]
},
"adp": [
{
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-09-26T23:08:21.420Z"
},
"title": "CISA ADP Vulnrichment",
"metrics": [
{}
]
}
]
}
}