froxlor through version 2.3.10 has a vulnerability (CVE-2026-100712) that allows an attacker to disable a logged-in user's two-factor authentication by triggering an unauthenticated GET request to the 2FA management endpoint (e.g., /customer_index.php?page=2fa&action=delete). The lack of CSRF protection on GET requests combined with the SameSite=Lax cookie setting enables cross-site top-level navigation to carry the victim's session and silently clear 2FA data without user confirmation or re-authentication. Both customer and admin 2FA handlers are vulnerable. This reduces account security to password-only authentication, which can be exploited if the password is compromised. The vulnerability is fixed in froxlor version 2.3.12.

An attacker can lure a logged-in froxlor panel user to visit a crafted link that disables the user's two-factor authentication silently and without consent. This reduces the account's security to password-only authentication, increasing the risk of account takeover if the password is compromised. Both customer and admin accounts are affected, potentially allowing attackers to escalate privileges or gain unauthorized access.

Upgrade froxlor to version 2.3.12 or later, where this vulnerability is fixed. Until then, users should be cautious about following untrusted links while logged into froxlor panels. There is no indication that additional mitigations such as configuration changes or workarounds are available.