CVE-2026-100712
Deferred Deferred - Pending Action

Two-Factor Authentication Bypass in Froxlor

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g. /customer_index.php?page=2fa&action=delete), with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers POST/PUT/PATCH/DELETE requests, and the session cookie is set to SameSite=Lax, so a cross-site top-level navigation (link click or redirect) carries the victim's session and silently clears type_2fa/data_2fa. Both the customer and admin 2FA handlers are affected. An attacker who lures a logged-in panel user into following a crafted link reduces that account to password-only authentication, which can be chained with a compromised password for account takeover. Fixed in 2.3.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100712
EUVD
EUVD-2026-87685

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor to 2.3.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in froxlor versions before 2.3.12 allows an attacker to disable a user's two-factor authentication (2FA) by tricking them into clicking a malicious link. The link triggers an unauthenticated GET request to the 2FA management page, which disables 2FA without confirmation or re-authentication. The session cookie's SameSite=Lax setting enables cross-site navigation to carry the victim's session, silently clearing 2FA settings.

Detection Guidance

Check Froxlor versions before 2.3.12 by running: froxlor --version or checking the web interface footer. Inspect server logs for GET requests to /customer_index.php?page=2fa&action=delete without POST methods or CSRF tokens. Monitor for unexpected 2FA disablings in user accounts.

Impact Analysis

An attacker can exploit this to reduce an account to password-only authentication. If the password is compromised, the attacker can gain full control of the account. This can lead to unauthorized access to sensitive data, system manipulation, or further attacks.

Compliance Impact

This vulnerability weakens authentication security, potentially violating compliance requirements for strong access controls in GDPR and HIPAA. It may lead to unauthorized data access, breaches, or non-compliance with security standards mandating multi-factor authentication.

Mitigation Strategies

Upgrade Froxlor to version 2.3.12 or later immediately. Disable GET requests for 2FA management actions by modifying the application code to require POST requests with CSRF tokens. Enable stricter session cookie settings beyond SameSite=Lax if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100712. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart