Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100709— Froxlor before 2.3.12 2FA Bypass via Namespace Confusion

Quick assessment

Affected
froxlor froxlor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Froxlor 2.3.10 及之前版本在存储“记住的 2FA 令牌”（panel_2fa_tokens）时，仅保存数值型用户 ID，未记录账户命名空间。登录时，对“记住的令牌”的查找过程未限制为特定账户类型（如客户或管理员）。由于客户和管理员的 ID 分别在不同的命名空间中分配，因此，某个 ID 合法发放给某位客户的“记住的 2FA 令牌”，也会匹配到具有相同 ID 的管理员账户。攻击者若能控制一个 ID 与之碰撞的客户账户，持有该客户有效的“记住的 2FA”Cookie，并且已知目标管理员的密码，即可绕过管理员

CVSS 7.5 · High EPSS 0.29% · P19
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100709

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Froxlor before 2.3.12 2FA Bypass via Namespace Confusion
Source: CVE Program / CVE List V5
Vulnerability Description
Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate namespaces, a remembered-2FA token legitimately issued to a customer with a given ID also matches an administrator with the same ID. An attacker who controls a customer account with a colliding ID, holds a valid remembered-2FA cookie for it, and already knows the target administrator's password can bypass the administrator's TOTP second factor and obtain an authenticated administrator session. This is a second-factor bypass only; it does not defeat password authentication. Fixed in 2.3.12.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
froxlor froxlor 0 ~ 2.3.12 -

II. Public POCs for CVE-2026-100709

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100709

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100709 (1)

Other References for CVE-2026-100709 (1)

Same Patch Batch · froxlor · 2026-09-26 · 13 CVEs total

CVE-2026-100717 9.9 CRITICAL froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
CVE-2026-100716 9.9 CRITICAL Froxlor before 2.3.12 Privilege Escalation via Symlink
CVE-2026-100715 9.6 CRITICAL Froxlor before 2.3.12 Arbitrary File Deletion via Symlink
CVE-2026-100714 9.1 CRITICAL Froxlor before 2.3.12 Command Injection via letsencryptchallengepath
CVE-2026-100720 8.7 HIGH Froxlor before 2.3.12 Stored XSS via SSL certificate issuer
CVE-2026-100713 7.8 HIGH Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
CVE-2026-100711 7.5 HIGH froxlor before 2.3.12 Authentication Bypass via Session Persistence
CVE-2026-100718 7.1 HIGH Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
CVE-2026-100708 7.1 HIGH Froxlor before 2.3.13 Private Key Disclosure via Certificates API
CVE-2026-100712 6.5 MEDIUM froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
CVE-2026-100719 6.5 MEDIUM Froxlor before 2.3.12 Credential Disclosure via DirProtections API
CVE-2026-100710 4.9 MEDIUM Froxlor before 2.3.12 DKIM Private Key Disclosure via API

IV. Related Vulnerabilities

Same product: froxlor
Same vendor: froxlor
Same weakness: CWE-287

V. Comments for CVE-2026-100709

No comments yet

Leave a comment