CVE-2026-62988: Multi-Factor Authentication and Credential Bypass in Froxlor API

Vulnerability ID: CVE-2026-62988
CVSS Score: 9.0
Published: 2026-08-18

An insecure data retrieval flaw in the Froxlor server administration panel API allows authenticated remote attackers to retrieve unredacted bcrypt password hashes and Base32-encoded Time-Based One-Time Password (TOTP) seeds. Affected endpoints include several 'get' and 'listing' handlers for customers, administrators, and FTP accounts. Utilizing these leaked parameters, attackers can crack the password hashes offline and concurrently generate valid second-factor authentication codes to completely bypass access controls.

TL;DR

Froxlor API endpoints leak raw bcrypt password hashes and raw TOTP seeds to authenticated users, enabling complete multi-factor authentication bypass and administrative takeover.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-200
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 9.0 (Critical)
Exploit Status: Proof of Concept (PoC) documented
CISA KEV Status: Not Listed
Impact: Authentication Bypass and Account Takeover

Affected Systems

Froxlor Server Administration Panel
froxlor: >= 2.3.7, < 2.3.8 (Fixed in: 2.3.8)

Code Analysis

Commit: 52a43fb

unset password and data_2fa in api get/listing commands

Commit: 8667fa3

fix API unset details for internal calls, fix Ftps typo

Mitigation Strategies

Upgrade Froxlor to version 2.3.8 or later immediately.
Manually apply hotfix commits to strip password and data_2fa parameters on non-internal API calls.
Invalidate and regenerate all user and administrator passwords and 2FA TOTP seeds.
Implement WAF rules to inspect API responses for patterns resembling bcrypt hashes and Base32 TOTP seeds.

Remediation Steps:

Step 1: Backup the Froxlor database and installation files.
Step 2: Update the codebase to version 2.3.8 or apply the manual patches from commit 8667fa3a4d77d6e322b7b8f7b9edbc1613ab5797.
Step 3: Force a password reset for all administrators and customer accounts.
Step 4: Instruct users to re-enroll their multi-factor authentication profiles to invalidate any potentially leaked TOTP seeds.
Step 5: Review application logs for unauthorized API access targeting user get and listing commands.