CVE-2026-100711

7.5 HIGHpublic exploit available

Published 2026-09-26 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-613

Public exploit & PoC references

https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff
https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff

All references

https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff
https://www.vulncheck.com/advisories/froxlor-before-2.3.12-authentication-bypass-via-session-persistence
https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100502PoC
MEDIUMCVE-2026-100554PoC
MEDIUMCVE-2026-100624PoC
UNSCOREDCVE-2026-101271
MEDIUMCVE-2026-102367PoC
MEDIUMCVE-2026-14465
UNSCOREDCVE-2026-67242PoC
HIGHCVE-2026-71206PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.