Froxlor versions through 2.3.10 have a vulnerability in their two-factor authentication (2FA) remembered-token mechanism. The system stores only a numeric user ID in remembered-2FA tokens without recording the account namespace, causing token lookups to be ambiguous between customer and administrator accounts. This allows an attacker who controls a customer account with a colliding ID and a valid remembered-2FA token, and who knows the administrator's password, to bypass the administrator's TOTP second factor and gain an authenticated administrator session. This vulnerability affects only the second-factor authentication step and does not bypass password authentication. The issue is fixed in version 2.3.12.