CVE-2026-100711
Deferred Deferred - Pending Action

Froxlor Session Persistence After Password Change

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100711
EUVD
EUVD-2026-87684

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor to 2.3.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects froxlor versions before 2.3.12 where changing a user's password does not invalidate existing sessions, API keys, or 2FA trust cookies. Attackers with hijacked sessions, valid API keys, or 2FA tokens retain full account access even after password rotation, bypassing security measures.

Detection Guidance

Check for active sessions, API keys, or 2FA trust cookies that remain valid after password changes. Review logs for unusual activity from hijacked sessions. Use commands like 'grep' on session files or database queries to identify lingering sessions. Monitor for unauthorized API key usage or persistent 2FA tokens.

Impact Analysis

If your account is compromised, attackers can maintain access even after you change your password. This includes retaining admin privileges, accessing sensitive data, and performing unauthorized actions. The vulnerability undermines standard security practices like password rotation and incident response.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating compliance requirements for data protection and access control. It undermines incident response procedures and may result in non-compliance with GDPR, HIPAA, and other regulations that mandate proper session management and access revocation.

Mitigation Strategies

Upgrade froxlor to version 2.3.12 or later. Manually invalidate all active sessions, revoke API keys, and purge 2FA trust cookies after any password change. Implement automated session cleanup and enforce strict session expiration policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart