CVE-2026-100711CWE-613

CVE-2026-100711

High · published September 26, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
16.3
In the wild
Unconfirmed
What it is

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00256 · 16.3th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-09-26T18:16Z
References (3)
https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff · [email protected]https://www.vulncheck.com/advisories/froxlor-before-2.3.12-authentication-bypass-via-session-persistence · [email protected]https://github.com/froxlor/froxlor/security/advisories/GHSA-57wv-g7m3-hmff · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 26 SEP 13:24Z
    froxlor before 2.3.12 Authentication Bypass via Session Persistence
    cvelistv5