https://vulnerability.circl.lu/sightings/feed 2026-08-21T08:17:43.777542+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1788d321-86fc-4ca5-8002-20e5f46b9507/export 2026-08-21T08:17:43.802227+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1788d321-86fc-4ca5-8002-20e5f46b9507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62988", "type": "published-proof-of-concept", "source": "Telegram/T_XByhyA_HALLjU76evu5RVvsn4zpzLoBf6fuRO_NOvcY2o", "content": "", "creation_timestamp": "2026-08-21T00:00:11.858731Z"} 2026-08-21T00:00:11.858731+00:00 https://vulnerability.circl.lu/sighting/8b3316ba-73d5-49ce-89e2-4665a4b90788/export 2026-08-21T08:17:43.805021+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8b3316ba-73d5-49ce-89e2-4665a4b90788", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62988", "type": "published-proof-of-concept", "source": "Telegram/T_XByhyA_HALLjU76evu5RVvsn4zpzLoBf6fuRO_NOvcY2o", "content": "", "creation_timestamp": "2026-08-20T03:00:03.714937Z"} 2026-08-20T03:00:03.714937+00:00 https://vulnerability.circl.lu/sighting/f83b4327-219f-4d3b-96f7-21e07bea545e/export 2026-08-21T08:17:43.805317+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f83b4327-219f-4d3b-96f7-21e07bea545e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62988", "type": "seen", "source": "https://gist.github.com/alon710/0cc60371850e568781debde747fcbd5a", "content": "# CVE-2026-62988: CVE-2026-62988: Multi-Factor Authentication and Credential Bypass in Froxlor API\n\n> **CVSS Score:** 9.0\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-62988\n\n## Summary\nAn insecure data retrieval flaw in the Froxlor server administration panel API allows authenticated remote attackers to retrieve unredacted bcrypt password hashes and Base32-encoded Time-Based One-Time Password (TOTP) seeds. Affected endpoints include several 'get' and 'listing' handlers for customers, administrators, and FTP accounts. Utilizing these leaked parameters, attackers can crack the password hashes offline and concurrently generate valid second-factor authentication codes to completely bypass access controls.\n\n## TL;DR\nFroxlor API endpoints leak raw bcrypt password hashes and raw TOTP seeds to authenticated users, enabling complete multi-factor authentication bypass and administrative takeover.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 9.0 (Critical)\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **CISA KEV Status**: Not Listed\n- **Impact**: Authentication Bypass and Account Takeover\n\n## Affected Systems\n\n- Froxlor Server Administration Panel\n- **froxlor**: >= 2.3.7, < 2.3.8 (Fixed in: `2.3.8`)\n\n## Mitigation\n\n- Upgrade Froxlor to version 2.3.8 or later immediately.\n- Manually apply hotfix commits to strip password and data_2fa parameters on non-internal API calls.\n- Invalidate and regenerate all user and administrator passwords and 2FA TOTP seeds.\n- Implement WAF rules to inspect API responses for patterns resembling bcrypt hashes and Base32 TOTP seeds.\n\n**Remediation Steps:**\n1. Step 1: Backup the Froxlor database and installation files.\n2. Step 2: Update the codebase to version 2.3.8 or apply the manual patches from commit 8667fa3a4d77d6e322b7b8f7b9edbc1613ab5797.\n3. Step 3: Force a password reset for all administrators and customer accounts.\n4. Step 4: Instruct users to re-enroll their multi-factor authentication profiles to invalidate any potentially leaked TOTP seeds.\n5. Step 5: Review application logs for unauthorized API access targeting user get and listing commands.\n\n## References\n\n- [Official GitHub Advisory](https://github.com/froxlor/froxlor/security/advisories/GHSA-7788-ghfq-c6mh)\n- [NVD Record](https://nvd.nist.gov/vuln/detail/CVE-2026-62988)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-62988)\n- [Remediation Release Tag](https://github.com/froxlor/froxlor/releases/tag/2.3.8)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-62988) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T10:31:45.393015Z"} 2026-08-19T10:31:45.393015+00:00 https://vulnerability.circl.lu/sighting/cdb745ef-56fa-487e-a71e-ecfdab394ec4/export 2026-08-21T08:17:43.805624+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "cdb745ef-56fa-487e-a71e-ecfdab394ec4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-62988", "type": "published-proof-of-concept", "source": "https://github.com/froxlor/froxlor/security/advisories/GHSA-7788-ghfq-c6mh", "content": "", "creation_timestamp": "2026-08-18T22:35:21.108934Z"} 2026-08-18T22:35:21.108934+00:00 https://vulnerability.circl.lu/sighting/5b7b1741-b934-4207-b582-02212534a528/export 2026-08-21T08:17:43.806600+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "5b7b1741-b934-4207-b582-02212534a528", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62988", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtf5yrhw3m2e", "content": "CVE-2026-62988 - froxlor\nFroxlor API endpoints from version 2.3.7 to 2.3.8 leaked sensitive customer and admin information. This allowed attackers with API access to obtain passwords and 2FA codes, potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#froxlor #CVE #infosec", "creation_timestamp": "2026-08-18T21:30:05.636025Z"} 2026-08-18T21:30:05.636025+00:00