The flaw enables an unauthenticated attacker to disable a user’s two‑factor authentication simply by directing a logged‑in user to a GET request that deletes the 2FA token, which does not require confirmation, re‑authentication, or a CSRF token. The result is a loss of 2FA protection and an elevated risk of password‑only account takeover, a classic CSRF weakness (CWE‑352).

The vulnerability exists in froxlor web panels through version 2.3.10, affecting both customer and administrator 2FA controllers. The fix is incorporated in froxlor 2.3.12 and later. No other products are listed as impacted.

With a CVSS score of 7.1, this issue is considered high severity. The EPSS score is not available, but the attack requires only a user clicking a malicious link; no special equipment or credentials are needed. The vulnerability is not present in the CISA KEV catalog. Because froxlor’s CSRF middleware protects only POST/PUT/PATCH/DELETE operations and the session cookie is set to SameSite=Lax, a top‑level navigation carries the session cookie and automatically clears the 2FA data, making exploitation trivial for an attacker.