CVE-2026-52793

Received Received - Intake

Authentication Bypass in Froxlor via API Key

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type_2fa, validating a TOTP code, or invoking FroxlorTwoFactorAuth. The web interface requires a second factor for accounts with two-factor authentication enabled, but the API grants access after validating only the API credentials, expiration, API permission, and account status. An attacker who obtains an API key and secret for a protected account can call the available API functions without supplying the configured second factor, which can expose or modify customer data, domains, email and FTP accounts, databases, DNS records, and certificate material. This issue is fixed in version 2.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-52793

Affected Vendors & Products

Vendor	Product	Version / Range
froxlor	froxlor	2.3.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Froxlor is server administration software with an API that prior to version 2.3.7 had a flaw in authentication. The API accepted administrator or customer API keys and secrets without requiring a second factor (TOTP) even if the account had two-factor authentication enabled. This allowed attackers with stolen API credentials to bypass 2FA and access sensitive functions.

Detection Guidance

Check Froxlor version with 'grep -r "define('FroxlorVersion'" /path/to/froxlor' or 'dpkg -l | grep froxlor'. If version is below 2.3.7, the system is vulnerable. Review API logs for unauthorized access attempts or unusual API calls from unexpected sources.

Impact Analysis

If you use Froxlor versions before 2.3.7, an attacker who obtains your API key and secret could access or modify customer data, domains, email accounts, databases, DNS records, and SSL certificates. This could lead to data breaches, service disruption, or unauthorized changes to your server configuration.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations, fines, and reputational damage if exploited.

Mitigation Strategies

Upgrade Froxlor to version 2.3.7 or later immediately. Rotate all API keys and secrets for administrator and customer accounts. Review API access logs for suspicious activity and disable API access if not required.

Hi! I’m here to help you understand CVE-2026-52793. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70