Authentication Bypass in Froxlor Web Hosting Panel

CVE-2026-100711

What is CVE-2026-100711?

Froxlor versions prior to 2.3.12 contain a significant flaw in session management. When users change their passwords, existing sessions, API keys, and 2FA trust cookies are not invalidated. This oversight allows attackers who have hijacked sessions or have valid API credentials to maintain unauthorized access to user accounts even after a password change. Consequently, any incident response actions taken by users may be rendered ineffective, potentially exposing sensitive information and compromising account security.

References