# CVE-2026-52793: Froxlor's API Authentication bypasses 2FA Authentication

Source: https://junglewise.ai/threats/cve-2026-52793-froxlor-s-api-authentication-bypasses-2fa-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18  
License: CC BY 4.0 with a link back

CVE-2026-52793 · Severity: high · CVSS 8.1 · Published 2026-08-18

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type_2fa, validating a TOTP code, or invoking FroxlorTwoFactorAuth. The web interface requires a second factor for accounts with two-factor authentication enabled, but the API grants access after validating only the API credentials, expiration, API permission, and account status. An attacker who obtains an API key and secret for a protected account can call the available API functions without supplying the configured second factor, which can expose or modify customer data, domains, email and FTP accounts, databases, DNS records, and certificate material. This issue is fixed in version 2.3.7.

Technologies: [froxlor/froxlor (Packagist)](https://junglewise.ai/threats/technologies/froxlor-froxlor). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-52793 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52793 being exploited in the wild.

**How severe is CVE-2026-52793?** High severity, with a CVSS score of 8.1, published 18 August 2026.

**Which products and versions are affected?** froxlor/froxlor (Packagist) ECOSYSTEM:introduced=0,fixed=2.3.7.

**Is there a fix for CVE-2026-52793?** Yes. froxlor/froxlor (Packagist): upgrade to 2.3.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-52793?** Check whether you run froxlor/froxlor (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- froxlor/froxlor (Packagist): upgrade to 2.3.7 or later

  ```sh
  composer require froxlor/froxlor:^2.3.7
  ```


## Affected products

- froxlor/froxlor (Packagist) ECOSYSTEM:introduced=0,fixed=2.3.7

## Identifiers

- CVE-2026-52793
- GHSA-f9rx-7wf7-jr36

## Related threats

- [Froxlor information disclosure in sender alias lookups](https://junglewise.ai/threats/cve-2026-90936-froxlor-information-disclosure-in-sender-alias-lookups)
- [Froxlor authorization bypass in Mysqls.add API](https://junglewise.ai/threats/cve-2026-90935-froxlor-authorization-bypass-in-mysqls-add-api)
- [Froxlor insecure file permissions in pure-ftpd MySQL configuration](https://junglewise.ai/threats/cve-2024-58383-froxlor-insecure-file-permissions-in-pure-ftpd-mysql)
- [Froxlor API credential and 2FA secret disclosure](https://junglewise.ai/threats/cve-2026-62988-froxlor-api-credential-and-2fa-secret-disclosure)
- [Froxlor CSRF vulnerability in AJAX endpoint](https://junglewise.ai/threats/cve-2026-55593-froxlor-csrf-vulnerability-in-ajax-endpoint)