Froxlor API Leak Exposes Password Hashes and 2FA Seeds
Froxlor has patched a critical API flaw in versions before 2.3.8 that could let a caller with the right API permissions pull sensitive data from full database records, including password hashes and TOTP seeds. INCIBE-CERT tied the issue to CVE-2026-62988 and said the leak can affect customer, admin, and FTP accounts.
The bug is in several API endpoints that return whole database rows instead of filtered responses. With a valid API key, an attacker can quietly collect password hashes for offline cracking and TOTP seeds to generate valid multifactor codes, so revoking the key alone may not remove the account risk if those secrets were already exposed.
For operators who use Froxlor as a hosting panel, the exposure sits at the account layer: once integration credentials are compromised, the API itself can hand over reusable login material, and the cleanup burden can extend to password and 2FA trust rather than just access revocation.