CVE-2026-52793: Froxlor's API Authentication bypasses 2FA Authentication

CVE-2026-52793 · Severity: high · CVSS 8.1 · Published 2026-08-18

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type_2fa, validating a TOTP code, or invoking FroxlorTwoFactorAuth. The web interface requires a second factor for accounts with two-factor authentication enabled, but the API grants access after validating only the API credentials, expiration, API permission, and account status. An attacker who obtains an API key and secret for a protected account can call the available API functions without supplying the configured second factor, which can expose or modify customer data, domains, email and FTP accounts, databases, DNS records, and certificate material. This issue is fixed in version 2.3.7.

Technologies: froxlor/froxlor (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-52793 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52793 being exploited in the wild.
How severe is CVE-2026-52793?
High severity, with a CVSS score of 8.1, published 18 August 2026.
Which products and versions are affected?
froxlor/froxlor (Packagist) ECOSYSTEM:introduced=0,fixed=2.3.7.
Is there a fix for CVE-2026-52793?
Yes. froxlor/froxlor (Packagist): upgrade to 2.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-52793?
Check whether you run froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • froxlor/froxlor (Packagist): upgrade to 2.3.7 or later
    composer require froxlor/froxlor:^2.3.7

Affected products

  • froxlor/froxlor (Packagist) ECOSYSTEM:introduced=0,fixed=2.3.7

Identifiers

  • CVE-2026-52793
  • GHSA-f9rx-7wf7-jr36

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.