CVE-2026-100709
Deferred Deferred - Pending Action

Authentication Bypass via 2FA Token Collision in Froxlor

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate namespaces, a remembered-2FA token legitimately issued to a customer with a given ID also matches an administrator with the same ID. An attacker who controls a customer account with a colliding ID, holds a valid remembered-2FA cookie for it, and already knows the target administrator's password can bypass the administrator's TOTP second factor and obtain an authenticated administrator session. This is a second-factor bypass only; it does not defeat password authentication. Fixed in 2.3.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100709
EUVD
EUVD-2026-87682

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
froxlor froxlor to 2.3.12 (exc)
froxlor froxlor From 2.3.0 (inc) to 2.3.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Froxlor versions 2.3.10 and earlier store remembered-2FA tokens using only a numeric user ID without tracking whether the account is a customer or administrator. This allows a token issued to a customer with a specific ID to also authenticate an administrator with the same ID. An attacker controlling a customer account with a matching ID can use a valid remembered-2FA token along with the administrator's password to bypass the administrator's TOTP second factor and gain full administrative access.

The vulnerability was fixed in Froxlor 2.3.12 by adding an account_type column to the tokens table to ensure tokens are only valid for their respective account types.

Detection Guidance

Check Froxlor version with 'froxlor --version' or via the web interface. Inspect the panel_2fa_tokens table in the Froxlor database for tokens without an account_type column. Look for duplicate numeric IDs across customer and administrator accounts.

Impact Analysis

If you are an administrator using Froxlor 2.3.10 or earlier, an attacker could bypass your 2FA and gain full administrative access to your Froxlor panel. This could allow the attacker to access customer data, modify configurations, or steal credentials. The attacker needs to know your password and have a remembered-2FA token from a customer account with a matching ID.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR's data protection principles or HIPAA's access controls. Unauthorized administrative access may result in data breaches, unauthorized disclosure, or modification of protected information, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Froxlor to version 2.3.12 or later immediately. Revoke all existing remembered-2FA tokens by clearing the panel_2fa_tokens table. Rotate all administrator passwords and 2FA secrets as a precaution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100709. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart