CVE-2026-100709

Executive Summary

CVE-2026-100709 is an authentication bypass vulnerability in Froxlor through version 2.3.10, where "remembered-2FA" tokens stored in the panel_2fa_tokens table contain only a numeric user ID and no account namespace (customer vs. administrator). Because customer and administrator IDs are drawn from separate sequences, a remembered-2FA token issued to a customer can collide with an administrator account sharing the same numeric ID. An attacker who controls a customer account with a colliding ID, possesses a valid remembered-2FA cookie for that account, and already knows the target administrator's password can bypass the administrator's TOTP second factor and obtain a fully authenticated administrator session. The vulnerability is a second-factor bypass only—it does not defeat password authentication—and is fixed in Froxlor 2.3.12.

Technical Analysis

Froxlor is a web-based server management panel historically positioned as a lightweight alternative to commercial hosting control panels; it exposes both a customer-facing interface and an administrator interface from the same installation. The flaw resides in the design of the "remembered-2FA" mechanism, which allows a user to skip the TOTP prompt on subsequent logins by presenting a persistent cookie after a prior successful 2FA challenge.

Per the NVD description, tokens are persisted in the panel_2fa_tokens table. The critical defect is that the record stores only a numeric user ID and does not record the account namespace (i.e., whether the ID refers to a customer or an administrator). During login, the remembered-token lookup is performed against the supplied numeric ID without constraining the query to the correct account type.

Compounding this, Froxlor allocates customer IDs and administrator IDs from separate numeric namespaces. As a result, a customer with ID N and an administrator with ID N are distinct entities that nevertheless produce an identical remembered-2FA token identifier. When the token lookup matches on N alone, a token legitimately minted for the customer is accepted for the administrator.

This is a textbook CWE-287 (Improper Authentication) instance. The root cause is twofold:

1. Loss of subject identity dimensions — the token record omits the account type, collapsing a two-dimensional identity (namespace + ID) into a single scalar.
2. Unqualified lookup — the authentication logic queries on the scalar without scoping to the authenticated principal's namespace.

The CVSS vector encodes real-world constraints honestly: AC:H (High) reflects the preconditions an attacker must satisfy (control of a colliding-ID customer account, possession of a valid remembered-2FA cookie, and knowledge of the target administrator's password), while PR:L (Low) reflects that only low-privileged customer credentials are required for the initial foothold. The high C/I/A impacts reflect that a successful bypass yields the full authority of the administrator account, which in Froxlor governs hosting, mail, DNS, and system-level configuration of managed accounts.

No public PoC, Nuclei template, or exploit code is available for this CVE, and the attack chain below is inferred strictly from the vulnerability class and the described mechanism; no specific source files, function names, or API endpoints beyond panel_2fa_tokens are documented in the available intelligence.

Exploitation Scenarios

The following chain is derived strictly from the NVD description. No public proof-of-concept exists; the steps describe the vulnerability class (remembered-token identity collision) at the mechanism level.

1. Reconnaissance / target identification. The attacker identifies a Froxlor instance running version 2.3.10 or earlier. Because Froxlor allocates customer and administrator IDs from independent sequences, an attacker operating a low-privileged customer account enumerates or infers its own numeric customer ID and searches for an administrator whose numeric ID collides. Collision probability is highest early in a deployment's life, when both namespaces are sparsely populated (e.g., customer ID 1 and administrator ID 1 are common first allocations).

2. Triggering the flaw class. The attacker logs into their own customer account, completes any required 2FA challenge, and elects the "remember" option, causing the panel to persist a remembered-2FA token in panel_2fa_tokens that records only the attacker's numeric ID. The attacker now holds a valid remembered-2FA cookie scoped (by ID) to their customer account.

3. Execution / second-factor bypass. The attacker navigates to the administrator login and submits the target administrator's password (obtained out-of-band via phishing, credential reuse, or prior disclosure—the vulnerability does not provide it). When the panel initiates the 2FA challenge, the attacker presents the remembered-2FA cookie. Because the login lookup matches on the numeric ID alone and does not constrain the query to the administrator namespace, the customer-issued token validates against the administrator record, and the TOTP requirement is skipped.

4. Post-exploitation impact. The attacker obtains an authenticated administrator session. Depending on the deployment, this grants authority to manage customer accounts, mail, DNS, and hosting configuration—i.e., the full administrative surface of the panel. The bypass is confined to the second factor; it cannot be reached without correct password knowledge, which materially constrains opportunistic exploitation but does not reduce impact once the preconditions are met.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector (Network): exploitation occurs over the panel's HTTP(S) interface.
• Attack Complexity (High): the attacker must satisfy three independent preconditions—control of a colliding-ID customer account, a valid remembered-2FA cookie for that account, and knowledge of the administrator's password. This reduces the population of viable targets and explains the High complexity rating.
• Privileges Required (Low): only a customer-level account is needed to mint the remembered token.
• User Interaction (None): the administrator need not take any action for the bypass to succeed.
• Scope (Unchanged): the compromised security authority remains within the panel.
• Confidentiality / Integrity / Availability (High): an authenticated administrator session grants full read and write control over managed accounts and configuration, and the potential to disrupt hosted services.

Blast radius: any Froxlor 2.3.10 (and earlier) deployment where a customer and an administrator share a numeric ID and the attacker holds the corresponding remembered-2FA cookie plus the administrator's password. Shared-hosting providers using Froxlor to manage many customer accounts are the primary exposure surface, as larger customer populations increase collision opportunities. The vulnerability is not in CISA KEV, no EPSS score has been assigned by FIRST.org, and there is no known exploit code or PoC in the wild at the time of writing. The severity stems from the privileged outcome (full admin session) rather than from ease of exploitation.

Detection Guidance

Detection must focus on anomalous remembered-2FA token activity and administrator sessions originating from the same client context as a customer account—specifically, use of a remembered-2FA cookie to authenticate into the administrator interface where the issuing subject was a customer.

Sigma Rule

title: Froxlor Remembered-2FA Token ID Collision Bypass (CVE-2026-100709)
id: 6f1c2a04-9d3e-4f7b-8c21-5a0e7d2b91aa
status: experimental
description: Detects login events where an administrator session is established via a remembered-2FA token whose subject is a customer account, consistent with the CVE-2026-100709 namespace collision.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100709
author: valtersit.com
date: 2026/01/01
logsource:
  product: froxlor
  service: auth
detection:
  selection_remembered:
    event_action: "login"
    auth_method: "remembered_2fa"
  selection_admin_context:
    account_type: "admin"
  selection_customer_token:
    token_subject_type: "customer"
  condition: selection_remembered and selection_admin_context and selection_customer_token
falsepositives:
  - Legitimate administrative accounts that also hold customer-scoped tokens in misconfigured deployments
level: high
tags:
  - attack.t1078
  - cve.2026.100709

YARA Rule

rule CVE_2026_100709_Froxlor_Remembered2FA_Token
{
    meta:
        description = "Detects Froxlor panel_2fa_tokens remembered-token records lacking account namespace context"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100709"
        date = "2026-01-01"
        severity = "high"

    strings:
        $table = "panel_2fa_tokens" ascii wide nocase
        $remember = "remembered-2FA" ascii wide nocase
        $remember2 = "rememberme" ascii wide nocase
        $froxlor = "froxlor" ascii wide nocase
        $customer = "customer" ascii wide nocase
        $admin = "admin" ascii wide nocase

    condition:
        $froxlor and $table and (any of ($remember*)) and ($customer or $admin)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100709 Froxlor Remembered-2FA Token Namespace Collision Login Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"login"; nocase; http.cookie; content:"remember"; nocase; http.cookie; content:"2fa"; nocase; reference:cve,2026-100709; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100709; classtype:attempted-admin; sid:2026100709; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [ authentication where event.action == "login" and froxlor.account.type == "customer" and froxlor.auth.method == "remembered_2fa" ]
  [ authentication where event.action == "login" and froxlor.account.type == "admin" and froxlor.auth.method == "remembered_2fa" ]

Splunk SPL Query

index=froxlor sourcetype="froxlor:auth"
| search event_action=login auth_method="remembered_2fa"
| stats values(account_type) as types values(token_subject_type) as subjects by src_ip, user_id
| where mvcount(types)>0 AND (mvfind(types,"admin")>=0 AND mvfind(subjects,"customer")>=0)

Wazuh OSSEC Rule

<group name="froxlor,web,authentication,">
  <rule id="2026100" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_action">login</field>
    <field name="auth_method">remembered_2fa</field>
    <field name="account_type">admin</field>
    <field name="token_subject_type">customer</field>
    <description>CVE-2026-100709: Froxlor administrator login via customer-issued remembered-2FA token (namespace collision).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in 2.3.12, but no vendor advisory, commit reference, or package version has been confirmed by any tracked patch source; treat deployments as unpatched until an authoritative fixed build is independently verified.

1) Immediate mitigations (until a verified fixed build is deployed):

• Disable the "remember 2FA" / remembered-2FA feature for both customer and administrator interfaces, forcing TOTP on every login. This removes the colliding-token precondition entirely.
• Enforce strong, unique administrator passwords and monitor for credential-reuse and phishing against admin staff, since the bypass still requires the administrator's password.
• Audit the panel_2fa_tokens table for records whose numeric IDs exist in both the customer and administrator namespaces; invalidate remembered tokens where namespace ambiguity exists.
• Restrict administrator login exposure (IP allow-listing, VPN, or a separate administrative interface) to reduce the attack surface.

2) Patch / upgrade steps:

• Monitor the Froxlor project for a 2.3.12 release or later and validate its authenticity before upgrading.
• Back up the database and configuration, then upgrade to 2.3.12 (or the earliest verified fixed release).
• After upgrading, invalidate all existing remembered-2FA tokens so that any pre-patch collision-tolerant tokens are purged, and require re-authentication.
• Confirm the fixed build scopes remembered-token lookups to the correct account namespace before resuming normal operation.

3) Long-term hardening:

• Require namespace-qualified identifiers (e.g., account type plus ID) for any authentication-relevant token or session record.
• Adopt a practice of forcing full re-authentication after any authentication-logic change.
• Implement centralized authentication logging and alerting for admin sessions established through non-interactive 2FA paths.
• Track Froxlor security advisories and subscribe to the project's release channel for prompt patch intake.

References

• NVD — CVE-2026-100709: https://nvd.nist.gov/vuln/detail/CVE-2026-100709
• Froxlor project (vendor) release and advisory channel: https://froxlor.org/
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• FIRST.org EPSS (no score assigned for this CVE at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-100709 at the time of writing; no public PoC, Nuclei template, or exploit code is available.