Froxlor CVE-2026-100709

Exploitation requires ALL of the following to hold simultaneously: (1) the attacker already knows the target administrator's password - this vuln only defeats the TOTP second factor, never password authentication; (2) the attacker controls a customer account whose numeric ID collides with the target administrator's ID, exploiting that customer and administrator IDs are allocated from separate namespaces while the remembered-2FA token (panel_2fa_tokens) stores only the bare numeric ID with no account-type namespace; (3) the attacker possesses a valid remembered-2FA cookie legitimately issued to that customer account. The exploitation vector is the login-time remembered-token lookup, which is not constrained to the customer-vs-administrator account type. Limiting factors: the mandatory prior password compromise, the need for an ID collision (not always achievable), and possession of a live remembered cookie make this a chained, targeted attack rather than a default-config remote takeover.

The vendor scores this 7.7 (CVSS 4.0, AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H), which is directionally reasonable but arguably generous on complexity. The exploit is not a standalone remote takeover: it is a second-factor-only bypass that presupposes the attacker ALREADY knows the target administrator's password, ALREADY controls a customer account whose numeric ID collides with that administrator's ID, and ALREADY holds a valid remembered-2FA cookie legitimately issued to that customer account. The AT:P (Present attack requirement) captures the ID-collision precondition, but the combination of password knowledge + colliding-ID account + valid remembered cookie is substantial and, in my view, closer to high attack complexity. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so this is 'no public exploit identified at time of analysis' - not active exploitation. There is no SSVC decision data supplied. Net: the impact IS severe (full administrator session on a panel that manages all tenants), but the multiple stacked preconditions make this a targeted, chained-attack issue rather than a mass-exploitable one. The realistic priority is moderate: patch it, but the password-precondition means it cannot be the sole entry point.

An attacker who has already phished or otherwise obtained a Froxlor administrator's password registers or controls a customer account whose numeric ID equals that administrator's ID, and obtains a remembered-2FA cookie for the customer account. At the admin login the attacker supplies the known password and presents the customer's remembered-2FA token, which the unconstrained lookup accepts across the account-type boundary, granting an authenticated administrator session without the TOTP second factor. No public exploit code is identified in the provided data.