Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100712— froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

Quick assessment

Affected
froxlor froxlor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Froxlor（版本 2.3.10 及之前）存在一个严重的安全漏洞。当未认证用户触发对 2FA 管理页面（例如 ）的 GET 请求时，系统会立即禁用该用户的两步验证（2FA）功能，过程中没有进行任何确认、重新认证或 CSRF 令牌验证。 尽管系统全局启用了 CSRF 中间件，但它仅覆盖 POST/PUT/PATCH/DELETE 请求。此外，会话 cookie 被设置为 ，因此跨站顶级导航（如点击链接或重定向）会携带受害者的会话信息，并静默清除 和 相关数据。此漏洞同时影响客户和管理员的 2FA 处理程序。 攻击者

CVSS 6.5 · Medium EPSS 0.13% · P2
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100712

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g. /customer_index.php?page=2fa&action=delete), with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers POST/PUT/PATCH/DELETE requests, and the session cookie is set to SameSite=Lax, so a cross-site top-level navigation (link click or redirect) carries the victim's session and silently clears type_2fa/data_2fa. Both the customer and admin 2FA handlers are affected. An attacker who lures a logged-in panel user into following a crafted link reduces that account to password-only authentication, which can be chained with a compromised password for account takeover. Fixed in 2.3.12.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
froxlor froxlor 0 ~ 2.3.12 -

II. Public POCs for CVE-2026-100712

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100712

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100712 (1)

Other References for CVE-2026-100712 (1)

Same Patch Batch · froxlor · 2026-09-26 · 13 CVEs total

CVE-2026-100717 9.9 CRITICAL froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
CVE-2026-100716 9.9 CRITICAL Froxlor before 2.3.12 Privilege Escalation via Symlink
CVE-2026-100715 9.6 CRITICAL Froxlor before 2.3.12 Arbitrary File Deletion via Symlink
CVE-2026-100714 9.1 CRITICAL Froxlor before 2.3.12 Command Injection via letsencryptchallengepath
CVE-2026-100720 8.7 HIGH Froxlor before 2.3.12 Stored XSS via SSL certificate issuer
CVE-2026-100713 7.8 HIGH Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
CVE-2026-100711 7.5 HIGH froxlor before 2.3.12 Authentication Bypass via Session Persistence
CVE-2026-100709 7.5 HIGH Froxlor before 2.3.12 2FA Bypass via Namespace Confusion
CVE-2026-100718 7.1 HIGH Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
CVE-2026-100708 7.1 HIGH Froxlor before 2.3.13 Private Key Disclosure via Certificates API
CVE-2026-100719 6.5 MEDIUM Froxlor before 2.3.12 Credential Disclosure via DirProtections API
CVE-2026-100710 4.9 MEDIUM Froxlor before 2.3.12 DKIM Private Key Disclosure via API

IV. Related Vulnerabilities

Same product: froxlor
Same vendor: froxlor
Same weakness: CWE-352

V. Comments for CVE-2026-100712

No comments yet

Leave a comment