froxlor versions up to 2.3.10 contain a vulnerability where an unauthenticated GET request to the two-factor authentication (2FA) management page disables a user's 2FA without confirmation or re-authentication. This occurs because the global CSRF protection does not cover GET requests, and the session cookie's SameSite=Lax setting allows cross-site navigation to carry the session, enabling silent 2FA disablement. Both customer and admin 2FA handlers are affected. The issue is fixed in version 2.3.12.