CVE-2026-52793

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.7

Description Froxlor server administration software contains an authentication bypass where the API does not enforce Two-Factor Authentication (2FA). While the web interface correctly requires a Time-based One-Time Password (TOTP) for accounts with 2FA enabled, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and the FroxlorRPC::validateAuth() function only validate the API key and secret. It fails to check the type 2fa status, validate a TOTP code, or invoke the FroxlorTwoFactorAuth class.

An attacker who obtains the API key and secret for a protected account can bypass the second factor to access and modify sensitive data, including customer information, domains, email and FTP accounts, databases, DNS records, and SSL certificate private keys.

Recommendations Update Froxlor to version 2.3.7. As a temporary mitigation, restrict access to the api.php endpoint or disable API key usage for accounts that have two-factor authentication enabled.