Is CVE-2026-100711 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100711 being exploited in the wild.

How severe is CVE-2026-100711?

High severity, with a CVSS score of 7.5, published 26 September 2026.

Is there a fix for CVE-2026-100711?

A patch was published on 2026-09-26: Version 2.3.12 includes fix to invalidate sessions and API keys on password change Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100711 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100711?

Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100711: froxlor session invalidation bypass on password change

CVE-2026-100711 · Severity: high · CVSS 7.5 · Published 2026-09-26

froxlor is a web hosting control panel that manages customer accounts and administrative access. When a user changes their password—a standard response to account compromise—the system fails to log out existing sessions, revoke API keys, or invalidate "remember device" tokens. An attacker with a stolen session cookie or API key retains full account access despite the password rotation, rendering incident response ineffective.

Technologies: Froxlor. Vendors: Froxlor.

Quick answers

Is CVE-2026-100711 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100711 being exploited in the wild.
How severe is CVE-2026-100711?: High severity, with a CVSS score of 7.5, published 26 September 2026.
Which products and versions are affected?: Froxlor before 2.3.12.
Is there a fix for CVE-2026-100711?: A patch was published on 2026-09-26: Version 2.3.12 includes fix to invalidate sessions and API keys on password change Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100711 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100711?: Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The password-update code paths in froxlor (Customers.php and Admins.php) modify only the password column and never trigger session_destroy() or revocation of API keys or 2FA trust tokens. Session authentication trusts $_SESSION['userinfo'], which is password-independent; API keys are revoked only on account deletion, not password change; and 2FA "remember device" tokens persist until cron expiry. An attacker holding a hijacked session, valid API key, or 2FA trust cookie can replay these artifacts for full account access after password rotation.

Affected products

froxlor froxlor before 2.3.12

Timeline

2026-09-26: disclosed: CVE-2026-100711 published; GHSA-57wv-g7m3-hmff advisory released
2026-09-26: patched: Version 2.3.12 includes fix to invalidate sessions and API keys on password change

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.