High severity7.5NVD Advisory· Published Sep 26, 2026· Updated Sep 26, 2026

CVE-2026-100711

Description

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.

Affected products

Froxlor/Froxlorllm-fuzzy
Range: <2.3.12

Patches

Vulnerability mechanics

References

github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmffnvd
www.vulncheck.com/advisories/froxlor-before-2.3.12-authentication-bypass-via-session-persistencenvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000