Robinmoschini

**Name of the Vulnerable Software and Affected Versions** Froxlor versions prior to 2.3.12 **Description** The software stores only a numeric user ID in remembered-2FA tokens within `panel 2fa tokens` without recording the account namespace. During login, the remembered-token lookup is not constrained to the customer or administrator account type. Since customer and administrator IDs are allocated from separate namespaces, a token issued to a customer with a specific ID can match an administrator with the same ID. An attacker who controls a customer account with a colliding ID, possesses a valid remembered-2FA cookie, and knows the target administrator's password can bypass the Time-based One-Time Password (TOTP) second factor to obtain an authenticated administrator session. This issue is a second-factor bypass and does not defeat password authentication. **Recommendations** Update to version 2.3.12.