Executive brief
froxlor is a web hosting control panel that manages customer accounts and administrative access. When a user changes their password—a standard response to account compromise—the system fails to log out existing sessions, revoke API keys, or invalidate "remember device" tokens. An attacker with a stolen session cookie or API key retains full account access despite the password rotation, rendering incident response ineffective.
Technical details
The password-update code paths in froxlor (Customers.php and Admins.php) modify only the password column and never trigger session_destroy() or revocation of API keys or 2FA trust tokens. Session authentication trusts $_SESSION['userinfo'], which is password-independent; API keys are revoked only on account deletion, not password change; and 2FA "remember device" tokens persist until cron expiry. An attacker holding a hijacked session, valid API key, or 2FA trust cookie can replay these artifacts for full account access after password rotation.
Affected products
- froxlor froxlor before 2.3.12
Timeline
- 2026-09-26: disclosed: CVE-2026-100711 published; GHSA-57wv-g7m3-hmff advisory released
- 2026-09-26: patched: Version 2.3.12 includes fix to invalidate sessions and API keys on password change