CVE-2026-62988: Multi-Factor Authentication and Credential Bypass in Froxlor API

CVE-2026-62988 is a critical information disclosure and authentication bypass vulnerability affecting Froxlor, an open-source server administration platform. The bug is located in the application's API layer, specifically within the command handlers responsible for managing administrators, customers, and FTP accounts. Affected versions include release 2.3.7 up to, but not including, version 2.3.8.

The attack surface is exposed through the authenticated JSON-RPC and REST API endpoints. Although an attacker must have valid API credentials to call the affected functions, the permissions required do not need to be administrative to access some of the vulnerable customer or FTP paths. This allows horizontal or vertical privilege escalation depending on the user's initial access level.

When queried, the API retrieves complete record definitions from the backend database. This data includes password hashes and multi-factor authentication secrets. Because the API layer originally serialized these records without removing security-critical fields, it returned them in cleartext and raw crypt formats to the calling client.

The underlying vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It stems from insecure over-fetching practices inside the database abstraction layer coupled with a lack of output filtering in the command controllers. The affected files are lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php.

In the vulnerable implementation, when a client calls the get or listing commands, the backend executes standard database queries using PHP Data Objects (PDO). The return value of these queries is a complete associative array representing the database rows. Crucially, fields containing sensitive secrets—specifically the password column (which stores bcrypt hashes) and the data_2fa column (which contains the Base32-encoded seed for Time-Based One-Time Passwords)—were fetched and retained within this array.

The controller immediately passed this unfiltered associative array into the $this->response() serialization function. This resulted in the direct exposure of both credentials within the API JSON payload. An authenticated user possessing permission to view their own account or other customer accounts could thereby extract the secret keys of targeted profiles.

The remediation of this vulnerability required two successive patches due to an initial logical flaw and a variable typo.

In the first patch (52a43fb826bb9a058faf9c39feeef7ac4444ceba), the developer attempted to employ a block-list sanitization strategy. The code iterated through the SQL query results and used the PHP unset() function to strip password and data_2fa keys before returning the array to the client.

// In lib/Froxlor/Api/Commands/Admins.php (Commit 1)
while ($row = $result_stmt->fetch(PDO::FETCH_ASSOC)) {
    unset($row['password']);
    unset($row['data_2fa']);
    $result[] = $row;
}

However, this first patch introduced a critical logical typo inside lib/Froxlor/Api/Commands/Ftps.php:

// In lib/Froxlor/Api/Commands/Ftps.php (Commit 1 - FLOPPED)
$result = Database::pexecute_first($result_stmt, $params, true, true);
if ($result) {
    unset($row['password']); // BUG: $row does not exist in this block; should be $result
    return $this->response($result);
}

Because $row was undefined in the Ftps.php::get() method, the unset() operation silently failed, and the full $result array containing the password field was sent back to the API client.

Furthermore, this global block-list approach broke internal backend processes. When other parts of the panel executed internal API calls (such as calling Admins.get during an update() workflow to check privileges), the sanitized array lacked the passwords and 2FA secrets required for internal validation.

To resolve both the typo and the internal breakage, the second patch (8667fa3a4d77d6e322b7b8f7b9edbc1613ab5797) introduced an internal execution flag checking routine ($this->isInternal()). When internal components invoke API functions, the flag is set to true, and the secrets remain available in the memory array. For external clients, $this->isInternal() evaluates to false, and the fields are stripped correctly.

// In lib/Froxlor/Api/Commands/Admins.php (Commit 2)
if (!$this->isInternal()) {
    unset($result['password']);
    unset($result['data_2fa']);
}

Exploiting this vulnerability requires network access to the Froxlor API endpoint and valid credentials or an active session token. An attacker sends a crafted API request to retrieve details about an administrator or user account. No user interaction or elaborate chaining is required to execute this step.

{
    "header": {
        "apikey": "attacker_api_key",
        "secret": "attacker_api_secret"
    },
    "body": {
        "command": "Admins.get",
        "params": {
            "id": 1
        }
    }
}

Upon receiving the API response, the attacker parses the JSON string to extract the password and data_2fa fields. The password field contains a standard blowfish/bcrypt password hash. The attacker then conducts offline dictionary or brute-force attacks against the hash using specialized utilities like Hashcat.

hashcat -m 3200 -a 0 froxlor_hash.txt wordlist.txt

Simultaneously, the attacker decodes the data_2fa string, which is the plaintext Base32-encoded TOTP seed. Using a utility such as oathtool, the attacker can instantly generate valid security codes in real-time.

oathtool --totp -b "JBSWY3DPEHPK3PXP"

Combining the cracked password with the synchronously generated TOTP code, the attacker logs in through the primary admin panel interface, completely bypassing multi-factor authentication barriers.

The impact of CVE-2026-62988 is severe, warranting a CVSS score of 9.0 (Critical). Because Froxlor is a server administration panel, compromising an administrative account yields full control over the underlying operating system. This allows the attacker to execute shell commands, alter database contents, modify web root files, and manage system services.

By obtaining both the password hash and the active TOTP seed, the attacker invalidates the entire multi-factor authentication model. There is no fallback security layer to prevent the login, as both elements of the 'something you know' and 'something you have' paradigms are exposed concurrently.

Additionally, the leakage of FTP passwords allows attackers to log in directly to file hosting environments via standard FTP clients, circumventing the web application interface entirely. This facilitates easy upload of web shells, ransomware, or arbitrary PHP injection vectors into all hosted websites.

The primary and recommended resolution is to upgrade the Froxlor installation to version 2.3.8 or higher. The release package contains both the API sanitization routines and the necessary logical checks to preserve internal backend functionality.

For deployments where immediate upgrading is not feasible, administrators should manually apply the second patch's code changes. It is critical to ensure that both password and data_2fa fields are unset when $this->isInternal() evaluates to false. Ensure that the FTP controller unsets $result['password'] instead of $row['password'] to prevent the typo bypass.

Additionally, after upgrading or applying the patch, administrators should enforce a panel-wide password reset and regenerate all TOTP secrets. Because the database fields were previously exposed, any administrator or customer record queried before the patch was applied should be treated as compromised. Defensive teams should inspect API query logs for anomalous invocations of Admins.get, Admins.listing, Customers.get, and Customers.listing to identify historical exploitation attempts.