Is CVE-2026-100711 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-100711?

CVE-2026-100711 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-100711

Description

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.