The vulnerability in froxlor versions prior to 2.3.12 allows an attacker who already possesses valid session cookies, API keys, or two‑factor authentication trust tokens to retain full access after a password change. Because the system does not invalidate these credentials when a user updates their password, the session persistence flaw effectively bypasses standard incident response actions that rely on password rotation to revoke access. This attack does not require exploiting a remote code execution path; it simply maintains authenticated access to the panel and associated API.

The flaw exists in all froxlor releases before version 2.3.12. The affected artifact is the web panel, the API interface, and the session handling subsystem. No specific version sub‑identifier is provided beyond having a release older than 2.3.12; any environment running such a release is vulnerable.

The CVSS score of 8.7 classifies this vulnerability as high severity. EPSS data are not available, so the exploitation likelihood is unknown, yet once an attacker has a session, key, or trust token the condition is trivial to satisfy. The vulnerability is not listed in CISA's KEV catalog. Because password changes do not revoke active credentials, an attacker can continue performing all authenticated actions until the session expires or the user logs out, effectively bypassing the intended security controls.