CVE-2026-62988: Froxlor: API leaks password hashes & TOTP seeds

Froxlor's admin API — specifically the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing commands — returns full database rows including the password hash and data_2fa (TOTP seed) fields that should have been stripped before the response left the server. This matters because it lets an authenticated caller with legitimate permission to those endpoints harvest both authentication factors in one shot: password hashes can be cracked offline while the exposure is unaddressed, and the Base32 TOTP seed can generate valid second-factor codes indefinitely until 2FA is reset, together enabling full takeover of admin, customer, or FTP accounts. The bar for exploitation is not zero — CVSS PR:H means the attacker needs an already-authenticated account with API access to these commands, and there is no public exploit, Nuclei template, EPSS score, or CISA KEV listing to suggest active or automated exploitation at this time. Still, the CVSS 3.1 score of 9.0 (critical) reflects real severity if that bar is cleared — a compromised reseller, a malicious or careless staff account, or a leaked API token is enough. Patch to Froxlor 2.3.8 immediately, and treat any account that had API access to these endpoints before patching as potentially compromised: rotate its password and reset its 2FA seed rather than assuming the exposure window was benign.

Proof-of-concept exploit code is publicly available for CVE-2026-62988, increasing the risk of exploitation.

Upgrade to Froxlor 2.3.8 immediately — the fix removes password and data_2fa fields from Customers/Admins/Ftps API responses (see the linked GitHub commits). Interim/compensating controls before patching: audit which API tokens or account roles currently hold permission to call Customers.get/listing, Admins.get/listing, and Ftps.get/listing, and revoke/tighten any that don't strictly need it. Treat the exposure as already-occurred for any account with that access prior to patching: rotate its password and reset its TOTP secret (re-enroll 2FA) rather than assuming no one abused the window. Detection: review Froxlor API access logs for calls to the six affected commands, particularly from reseller/customer-scoped credentials targeting Admins.get or other customers' Ftps.get — that pattern indicates likely abuse rather than legitimate self-service use.

CVE-2026-62988 has a CVSS v3.1 base score of 9.0 (CRITICAL). The EPSS exploitation probability is 0.63%.