Froxlor up to 2.3.7 CSRF Token Validation Ajax.php Ajax::editApiKey cross-site request forgery

Summaryinfo

A vulnerability was found in Froxlor up to 2.3.7. It has been classified as problematic. The affected element is the function Ajax::editApiKey of the file lib/Froxlor/Ajax/Ajax.php of the component CSRF Token Validation. The manipulation leads to cross-site request forgery. This vulnerability is documented as CVE-2026-55593. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Froxlor up to 2.3.7 and classified as problematic. This issue affects the function Ajax::editApiKey of the file lib/Froxlor/Ajax/Ajax.php of the component CSRF Token Validation. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. The summary by CVE is:

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions. This issue is fixed in version 2.3.8.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-55593 since 06/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:lib/Froxlor/Ajax/Ajax.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.3.8 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Froxlor

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7

License

• open-source

Website

• Product: https://github.com/froxlor/froxlor/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion