The vulnerability arises from certain Froxlor API endpoints that return full database rows, including the password_hash and data_2fa fields. When an authenticated caller with appropriate permissions invokes Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get or Ftps.listing, the API response contains the stored password hashes and Base32-encoded TOTP seeds for each account. The disclosure of these artifacts allows an attacker to crack passwords offline and generate valid TOTP codes; together, this permits bypassing both factors of authentication and enabling takeover of the hosting panel or hosted resources.

Vendors: froxlor. Product: Froxlor server administration software. Versions affected: 2.3.7 through, but not including, 2.3.8. The issue is fixed in Froxlor 2.3.8.

CVSS score of 9.0 indicates high severity. The EPSS score is currently unavailable, so the precise exploitation likelihood is unknown, but the vulnerability is not listed in the CISA KEV catalog. An attacker must gain authenticated API access with permissions to the vulnerable endpoints, which is a realistic scenario in a multi-tenant hosting environment. Once access is achieved, the attacker can download the password hashes and 2FA seeds directly; cracking the hashes offline and using the seeds to compute TOTP codes would enable successful account takeover without additional lateral movement.