Froxlor versions prior to 2.3.12 generate a remembered‑2FA token that stores only the numeric user ID and omits the distinction between customer and administrator namespaces. When the login system verifies a token, it does not restrict the lookup to the correct account type, allowing a token issued to a customer account with a colliding numeric ID to be accepted for an administrator account of the same ID. An attacker who controls such a colliding customer account and has a valid remembered‑2FA cookie for that account can combine that cookie with a known administrator password to bypass the administrator’s TOTP second factor and gain an authenticated administrator session. The vulnerability does not compromise password authentication itself, but it removes the second‑factor protection for the affected administrators.

The flaw resides in the Froxlor web hosting management interface and affects all Froxlor installations that are version 2.3.10 or earlier.

The CVSS score of 7.7 indicates a high severity of the flaw. EPSS data are not available, and the vulnerability has not been listed in the CISA KEV catalog. Exploitation requires the attacker to already possess a colliding customer account ID, a valid remembered‑2FA cookie for that account, and knowledge of an administrator’s password. While the conditions limit the attack to highly targeted scenarios, the possibility of bypassing second‑factor protection for administrators warrants a cautious approach. The likely attack vector is a web‑based login flow where the attacker leverages a stolen cookie and a known admin password to elevate privileges.