froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. (CVE-2026-100711)
froxlor versions before 2.3.12 do not invalidate existing panel sessions, API keys, and 2FA trust cookies when a user changes their password. This allows attackers who have hijacked sessions or possess valid API keys or 2FA trust tokens to maintain full account access even after password rotation, effectively bypassing incident response measures.
AI Analysis
Technical Summary
The vulnerability identified as CVE-2026-100711 affects froxlor versions prior to 2.3.12. When a user changes their password, the system fails to invalidate existing panel sessions, API keys, and two-factor authentication (2FA) trust cookies. Consequently, attackers who have hijacked sessions or hold valid API keys or 2FA trust tokens can continue to access the account despite the password change. This flaw undermines the security mechanism intended to revoke access upon credential updates and is classified under CWE-613 (Insufficient Session Expiration).
Potential Impact
Attackers with hijacked sessions, valid API keys, or 2FA trust tokens retain full access to user accounts even after the legitimate user changes their password. This bypasses standard incident response actions such as password rotation, potentially allowing prolonged unauthorized access without detection or interruption.
Mitigation Recommendations
Upgrade froxlor to version 2.3.12 or later, where this issue is fixed. Versions before 2.3.12 are vulnerable because they do not invalidate sessions, API keys, and 2FA trust cookies upon password change. No vendor advisory or patch link is provided here, but the version 2.3.12 is explicitly stated as the fixed version.
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. (CVE-2026-100711)
Description
froxlor versions before 2.3.12 do not invalidate existing panel sessions, API keys, and 2FA trust cookies when a user changes their password. This allows attackers who have hijacked sessions or possess valid API keys or 2FA trust tokens to maintain full account access even after password rotation, effectively bypassing incident response measures.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2026-100711 affects froxlor versions prior to 2.3.12. When a user changes their password, the system fails to invalidate existing panel sessions, API keys, and two-factor authentication (2FA) trust cookies. Consequently, attackers who have hijacked sessions or hold valid API keys or 2FA trust tokens can continue to access the account despite the password change. This flaw undermines the security mechanism intended to revoke access upon credential updates and is classified under CWE-613 (Insufficient Session Expiration).
Potential Impact
Attackers with hijacked sessions, valid API keys, or 2FA trust tokens retain full access to user accounts even after the legitimate user changes their password. This bypasses standard incident response actions such as password rotation, potentially allowing prolonged unauthorized access without detection or interruption.
Mitigation Recommendations
Upgrade froxlor to version 2.3.12 or later, where this issue is fixed. Versions before 2.3.12 are vulnerable because they do not invalidate sessions, API keys, and 2FA trust cookies upon password change. No vendor advisory or patch link is provided here, but the version 2.3.12 is explicitly stated as the fixed version.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xf4r-hwm6-xhx6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100711"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ab89bd7f7a7c54106941fed
Added to database: 09/27/2026, 04:30:15 UTC
Last enriched: 09/27/2026, 04:40:04 UTC
Last updated: 09/27/2026, 05:47:42 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.