CVE-2026-100709: Froxlor before 2.3.12 2FA Bypass via Namespace Confusion
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel2fatokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate namespaces, a remembered-2FA token legitimately issued to a customer with a given ID also matches an administrator with the same ID. An attacker who controls a customer account with a colliding ID, holds a valid remembered-2FA cookie for it, and already knows the target administrator's password can bypass the administrator's TOTP second factor and obtain an authenticated administrator session. This is a second-factor bypass only; it does not defeat password authentication. Fixed in 2.3.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.12
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker must control a customer account whose numeric ID collides with the target administrator's ID, possess a valid remembered-2FA cookie issued for that customer account, and already know the target administrator's password. The issue does not allow an attacker to bypass password authentication.
Are administrator accounts affected by a customer account's remembered-2FA token?
Yes. In affected versions, remembered-2FA tokens contain only a numeric user ID and token lookup does not restrict the account type. Since customer and administrator IDs use separate namespaces, the same numeric ID can exist for both account types.
What should be done to remediate the issue?
Upgrade Froxlor to version 2.3.12, which fixes the namespace confusion in remembered-2FA token handling.
How can an organization assess whether exploitation conditions exist?
Review whether customer and administrator accounts share numeric IDs, and identify customer accounts that have valid remembered-2FA tokens. Exploitation additionally requires that the attacker know the password for the administrator account with the colliding ID.