CVE-2026-100711

8.7 highEPSS 0.3%

High (8.7). EPSS 0.3% chance of exploitation in the next 30 days.

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-613
Published: 2026-09-26
Modified: 2026-09-28
Record from: the NVD, synced 2026-10-19

References

https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff
https://www.vulncheck.com/advisories/froxlor-before-2.3.12-authentication-bypass-via-session-persistence
https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff

Check your stack JSON