Froxlor through version 2.3.10 stores remembered-2FA tokens (panel_2fa_tokens) using only a numeric user ID without the account namespace, leading to ambiguity between customer and administrator accounts since their IDs are allocated from separate namespaces. During login, the remembered-token lookup is not restricted by account type, so a token issued to a customer with a given ID can also match an administrator with the same ID. An attacker controlling a customer account with a colliding ID and holding a valid remembered-2FA cookie, combined with knowledge of the administrator's password, can bypass the administrator's TOTP second factor and obtain an authenticated administrator session. This vulnerability is a second-factor bypass only and does not circumvent password authentication. The flaw is addressed in Froxlor version 2.3.12.

An attacker who controls a customer account with a user ID that collides with an administrator's ID and who possesses a valid remembered-2FA token for that customer account can bypass the administrator's two-factor authentication. This allows the attacker to gain an authenticated administrator session if they also know the administrator's password. The vulnerability compromises the integrity of the second-factor authentication but does not affect password verification. This could lead to unauthorized administrative access.

This vulnerability is fixed in Froxlor version 2.3.12. Users and administrators should upgrade to version 2.3.12 or later to remediate this issue. No other mitigations are indicated by the vendor advisory.