CVE-2026-62988 froxlor CVE debrief

Who should care

System administrators using Froxlor server administration software, especially those with API integrations or exposed instances, should be aware of this vulnerability and take immediate action to protect their systems. This includes reviewing and restricting API permissions, implementing additional monitoring, updating to version 2.3.8 or later, rotating passwords and TOTP seeds for affected accounts, and enabling two-factor authentication for all accounts. Additionally, security teams and vulnerability management teams should prioritize this vulnerability due to its critical severity and potential impact on hosting panel or hosted resources security.

Technical summary

The Froxlor server administration software has a vulnerability in its API commands for customers, admins, and FTP users. An authenticated API caller can obtain full database rows, including password hashes and Base32-encoded TOTP seeds, which can be used to crack passwords offline and generate valid second-factor codes. The vulnerability exists in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php. This issue is fixed in version 2.3.8. To mitigate, review and restrict API permissions, implement additional monitoring, update to version 2.3.8 or later, rotate passwords and TOTP seeds for affected accounts, and enable two-factor authentication for all accounts.

Defensive priority

Authenticated API callers with permission can exploit this vulnerability to obtain sensitive information, including password hashes and TOTP seeds, which can lead to account takeover.

Recommended defensive actions

• Review and restrict API permissions to limit exposure
• Implement additional monitoring for API usage
• Update to version 2.3.8 or later
• Rotate passwords and TOTP seeds for affected accounts
• Enable two-factor authentication for all accounts

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in Froxlor server administration software. The vulnerability exists in API commands for retrieving customer, administrator, and FTP information without removing sensitive fields.

Official resources