The vulnerability resides in the API authentication pathway where an API key and secret can be verified without checking if a two‑factor authentication (2FA) requirement is set for the user. An attacker who obtains such credentials can trigger any API call that the account normally has permission for, bypassing the guardian TOTP code. The impact is that privileged operations—such as creating or deleting accounts, altering DNS, certificates, or domains—can be performed by an entity without the second factor, exposing or modifying sensitive customer data.

The flaw affects the open‑source Froxlor server administration software. All releases before version 2.3.7 are vulnerable. It applies to both administrator and customer user accounts that have 2FA enabled. The software is distributed under the name froxlor and runs on typical web servers that host the Froxlor instance.

The severity is high with a CVSS score of 8.1. The EPSS score is not available, so the publicly known exploitation probability cannot be quantified at this time. Froxlor is not yet listed in the CISA KEV catalog, indicating that no confirmed field‑deployed attacks are reported. The attack vector is remote, via the public API, and requires possession of a valid API key and secret for an affected account. The attacker does not need to breach the web interface or satisfy the TOTP challenge, making the bypass easier for anyone who can compromise or brute‑force the API credentials.