Froxlor API two-factor authentication bypass

Executive brief

Froxlor is a server management panel used to manage hosting services like domains, emails, and databases. A security flaw in its API allows attackers who have obtained an API key and secret to completely bypass two-factor authentication (2FA). This means that even if a user has enabled 2FA to protect their account, an attacker can still gain full control over their data, including private SSL keys and customer information, without needing the second security code.

Technical details

The vulnerability exists in the `FroxlorRPC::validateAuth` method within `lib/Froxlor/Api/FroxlorRPC.php`. While the web UI correctly enforces TOTP verification, the API authentication logic only validates the API key and secret against the database, entirely omitting checks for the user's 2FA status (`type_2fa`). An attacker with a leaked or stolen API key and secret can perform any of the 165 available API functions, including sensitive write operations and data exfiltration (PII, private keys, DNS records), without providing a TOTP code. The issue is addressed in version 2.3.7.

Affected products

• Froxlor froxlor/froxlor < 2.3.7

Timeline

• 2026-05-29: disclosed
• 2026-06-03: advisory

References

• https://api.github.com/users/hett-patell
• https://github.com/hett-patell
• https://api.github.com/users/hett-patell/gists%7B/gist_id%7D
• https://api.github.com/users/hett-patell/repos
• https://avatars.githubusercontent.com/u/221814716?v=4
• https://api.github.com/users/hett-patell/events%7B/privacy%7D