Froxlor API Credential and 2FA Secret Disclosure

The Froxlor hosting management software (versions prior to 2.3.8) contains a critical information disclosure vulnerability (CVE-2026-62988) in its API command classes. The vulnerability stems from API endpoints in Customers, Admins, and Ftps classes retrieving and returning full database rows directly through the response handler without filtering sensitive data.

Defenders must recognize that attackers with legitimate, low-privileged API access can invoke these commands to exfiltrate password hashes and TOTP 2FA seeds for administrative, customer, and FTP accounts. This exposure poses a severe risk, as attackers can perform offline cracking on the password hashes and use the leaked TOTP seeds to generate valid second-factor authentication codes, effectively bypassing MFA. The persistence of the TOTP secret makes this a long-term risk for any account that has had its data exposed via the API.

Impact

The vulnerability allows authenticated API users to retrieve credential-equivalent material for all accounts visible to their API scope. Successful exploitation facilitates unauthorized access to hosting panels, FTP services, and hosted content. Because the disclosure includes both password hashes and 2FA seeds, it enables a full bypass of authentication mechanisms for affected administrative and customer accounts. The scope of impact is limited to the hosting environment but includes both customer and high-privilege administrator data.

Recommendation

• Patch Froxlor to version 2.3.8 or later immediately to address CVE-2026-62988.
• Audit web server access logs for anomalous API activity, specifically focusing on POST requests to api.php that invoke Customers.listing, Admins.listing, or Ftps.listing commands.
• For all accounts that were potentially exposed through these API endpoints, initiate a mandatory password reset and 2FA seed rotation.
• Implement strict API key management; verify that API keys are only provisioned to trusted, internal service accounts and enforce the principle of least privilege for API permissions.
• Review web server logs for high-frequency or bulk data requests to the Froxlor API from authorized service accounts, which may indicate exfiltration of credential data.