Medium severity6.5NVD Advisory· Published Sep 26, 2026· Updated Sep 26, 2026
CVE-2026-100719
CVE-2026-100719
Description
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure of reused credentials.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- Froxlor: Thirteen Vulnerabilities Including Critical Flaws Disclosed TogetherVypr Intelligence · Sep 26, 2026