PT-2026-99382

CVE-2026-100711

Published

2026-09-26

Updated

2026-09-26

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions froxlor versions prior to 2.3.12

Description The software fails to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. This allows attackers who possess hijacked sessions, valid API keys, or 2FA trust tokens to maintain full account access even after a password rotation, effectively bypassing incident response measures.

Recommendations Update to version 2.3.12 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Skeletonsec

Vendors

Affected products

Weakness enumeration

CWE-613: Insufficient Session Expiration

Related identifiers