CVE-2026-100712: froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-26 · updated 2026-09-28
Weakness: CWE-352

Description

froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g. /customer_index.php?page=2fa&action=delete), with no confirmation, re-authentication, or CSRF token. The global CSRF middleware only covers POST/PUT/PATCH/DELETE requests, and the session cookie is set to SameSite=Lax, so a cross-site top-level navigation (link click or redirect) carries the victim's session and silently clears type_2fa/data_2fa. Both the customer and admin 2FA handlers are affected. An attacker who lures a logged-in panel user into following a crafted link reduces that account to password-only authentication, which can be chained with a compromised password for account takeover. Fixed in 2.3.12.

Affected products

froxlor: before 2.3.12 — fixed in 2.3.12

How to fix

Upgrade to a fixed version: froxlor 2.3.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-100712 or the next vulnerability affects your stack