CVE-2026-62988: Froxlor Credential and 2FA Secret Disclosure via API Endpoints
Summary
CVE-2026-62988: Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints. Affects froxlor/froxlor versions < 2.3.8. Fixed in 2.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Froxlor is an open-source server management panel that allows users to manage their hosting environments efficiently. It provides functionalities for managing customers, administrators, and FTP users, along with support for two-factor authentication (2FA) to enhance security. However, certain API endpoints in Froxlor have been found to expose sensitive authentication data, making it vulnerable to exploitation.
Vulnerability Detail
The vulnerability arises from several Froxlor API command classes that return sensitive authentication material, including password hashes and TOTP 2FA seeds, in JSON API responses. The affected endpoints use full-row database queries and do not filter out sensitive fields before returning the results. This exposure allows authenticated API users to retrieve credential material for accounts, potentially leading to account takeovers and unauthorized access to sensitive resources. The vulnerability is particularly severe when both password hashes and TOTP seeds are exposed for the same account, as it can defeat both factors of authentication.
How To Fix
Minimum fixed version
2.3.8
This is the first release that contains the fix.
composer require froxlor/froxlor:2.3.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually filter out sensitive fields from the API responses in the affected API command classes before calling the response method. For example, modify the response code to exclude the 'password' and 'data_2fa' fields:
$this->response(array_map(function($item) {
unset($item['password'], $item['data_2fa']);
return $item;
}, $result));
Conclusion
The Froxlor vulnerability CVE-2026-62988 poses a significant risk by exposing sensitive authentication data through API endpoints. It is crucial to update to the patched version or implement workarounds to mitigate the risk of exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for froxlor/froxlor →
FAQ
CVE-2026-62988 is a vulnerability in Froxlor that allows the disclosure of sensitive authentication information, including password hashes and TOTP 2FA seeds, through certain API endpoints.
An authenticated API user can exploit this vulnerability to retrieve sensitive credential material for accounts, potentially leading to account takeovers and unauthorized access.
The consequences include the risk of account takeover, unauthorized access to hosting panels, FTP file access, and the ability to modify hosted websites.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If you cannot update, implement the suggested workaround to filter out sensitive fields from API responses until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for froxlor/froxlor.
