Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100712froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

Medium 6.5

In plain English

A medium-severity cross-site request forgery in froxlor from froxlor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.1%top 96.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g. /customer_index.php?page=2fa&action=delete), with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers POST/PUT/PATCH/DELETE requests, and the session cookie is set to SameSite=Lax, so a cross-site top-level navigation (link click or redirect) carries the victim's session and silently clears type_2fa/data_2fa. Both the customer and admin 2FA handlers are affected. An attacker who lures a logged-in panel user into following a crafted link reduces that account to password-only authentication, which can be chained with a compromised password for account takeover. Fixed in 2.3.12.

Affected products (as reported)

Vendor	Product	Versions
froxlor	froxlor	0 – before 2.3.12

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-w582-7wqv-62mm) vendor-advisory
VulnCheck Advisory: froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF third-party-advisory