2FA Bypass Vulnerability in Froxlor Affected by Namespace Confusion

CVE-2026-100709

What is CVE-2026-100709?

Froxlor versions prior to 2.3.12 are vulnerable to a 2FA bypass issue caused by improper storage of remembered tokens. The application saves only the numeric user ID in 2FA tokens without associating it with the specific account namespace. This flaw permits an attacker with access to a customer account to exploit a user ID collision with an administrator account, allowing them to bypass the Time-based One-Time Password (TOTP) second factor when the administrator's password is already known. This vulnerability underlines the importance of proper namespace management and secure token handling in authentication processes.

References