high7.5
CVE-2026-100711
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed.
Impact
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.
Affected products
| Product | Affected versions |
|---|---|
| Froxlor | before 2.3.12 |
Versions were read from the advisory text. No structured product data has been published for this record yet.