CyberRota Analysis
AI-GeneratedFroxlor versions prior to 2.3.12 are vulnerable due to their failure to invalidate existing sessions, API keys, and 2FA trust cookies upon a password change. This oversight allows attackers with hijacked sessions or valid credentials to maintain full account access, undermining security measures intended to mitigate unauthorized access. Organizations using Froxlor should prioritize updating to the latest version to safeguard against potential account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.