froxlor versions before 2.3.12 do not invalidate existing panel sessions, API keys, and 2FA trust cookies when a user changes their password. This allows attackers who have hijacked sessions or possess valid API keys or 2FA trust tokens to maintain full account access even after password rotation, effectively bypassing incident response measures.