Description

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-26T14:16:56.743Z",
  "pubdate": "2026-09-26T14:16:56.743Z",
  "executiveSummary": "Froxlor versions prior to 2.3.12 exhibit a critical security flaw regarding session and credential management during user password rotation. The vulnerability is categorized as an improper authentication state management issue, where the application fails to invalidate existing session tokens, API keys, and 2FA trust cookies upon a successful password change.\nThe impact of this vulnerability is severe, as it renders password rotation ineffective as a security remediation or incident response measure. An attacker who has already compromised a user session, obtained a functional API key, or intercepted a 2FA trust cookie maintains unauthorized persistence within the panel, even after the legitimate user has updated their credentials.\nThis flaw allows unauthorized access to persist indefinitely until the original tokens naturally expire or are manually purged. The vulnerability affects all Froxlor installations below version 2.3.12, posing a significant risk to administrative account security and general user session integrity. No specific exploitation requirements are noted other than the prior possession of valid, pre-rotation authentication material, enabling an attacker to bypass standard security controls.",
  "technicalDetails": "The root cause of the vulnerability lies in the Froxlor authentication handler’s failure to implement a revocation mechanism for active security identifiers when a user's password hash is updated in the database. In secure web application architecture, a password change should trigger the invalidation of all existing session identifiers (SIDs) and auxiliary authentication tokens associated with that user UID to ensure that any potential session hijacking is mitigated.\nUnder normal operating conditions, when a user initiates a password update, the application updates the corresponding row in the user authentication table. However, the Froxlor backend fails to clear the associated session storage (typically located in the database or server-side session files) or invalidate the specific API key entries mapped to that account. Furthermore, 2FA trust cookies, which effectively bypass secondary authentication, remain cryptographically valid despite the primary password change, as the system does not correlate these tokens with the password change event.\nThe attack flow for this vulnerability occurs as follows: 1) An attacker successfully compromises a user session or steals an API key through means such as XSS, session fixation, or network sniffing. 2) The legitimate user, suspecting a compromise or following security policy, changes their password via the Froxlor interface. 3) The application confirms the password update, providing the user with a false sense of security. 4) The attacker, despite the password change, continues to present the previously obtained session cookie or API key to the Froxlor API/web panel. 5) Because the server-side authentication check fails to compare the existing session's generation timestamp or token validity against the user's latest password change metadata, the server accepts the stale credential as legitimate.\nThe vulnerable component is the internal authentication management module within Froxlor versions prior to 2.3.12. The scope of the vulnerability extends to the panel sessions, API access layers, and the persistent 2FA trust management system. There are no privilege requirements for the attacker to utilize the already stolen credentials, as the system treats the stale session as fully authenticated and authorized based on its stored state. This vulnerability allows an attacker to bypass incident response actions entirely, as the password rotation—intended to force a re-authentication and session clear—does not affect the persistent session storage in the target environment."
}