Froxlor API Endpoints Leak Password Hashes and TOTP Seeds for Admins, Customers, and FTP Users

A newly published GitHub Security Advisory (GHSA-7788-ghfq-c6mh, tracked as CVE-2026-62988, CVSS 9.0) reports that several Froxlor API command classes return sensitive authentication material in JSON responses. Froxlor is an open-source web hosting control panel.

What was reported

According to the advisory, the Customers.get/Customers.listing, Admins.get/Admins.listing, and Ftps.get/Ftps.listing API commands perform full-row database queries (SELECT * or equivalent) and pass the results directly to the response without stripping sensitive fields. This exposes password (bcrypt hashes) for customers, administrators, and FTP users, plus data_2fa — the Base32-encoded TOTP seed — for accounts with 2FA enabled. A proof of concept in the advisory shows an authenticated API client retrieving these fields via standard API calls and using an exposed seed to generate a valid TOTP code with a short Python script. The advisory notes this is inconsistent with other Froxlor API classes that already strip password fields before responding.

Why it matters

This affects any Froxlor instance with the API enabled and at least one issued API key/secret pair. Because the vulnerability can expose both a password hash and its corresponding TOTP seed for the same account, it can undermine both authentication factors at once — an attacker who cracks a weak or reused password offline could pair it with the leaked TOTP seed to fully authenticate, no live 2FA prompt required. Administrator account exposure is especially significant given the privileged, server- and customer-level actions available from the admin panel; customer and FTP exposure could lead to unauthorized access to hosted sites, mail, databases, and file storage. Given a public PoC and a CVSS of 9.0, exploitation requires only an existing API credential with access to the affected endpoints — not a pre-auth path, but a low bar in environments where API keys are shared or loosely scoped.

What defenders should do now

• Identify Froxlor deployments and check for available patched releases; apply updates per the advisory once released.
• Audit who holds Froxlor API keys/secrets and tighten scope/permissions on accounts that can call Customers.*, Admins.*, or Ftps.* endpoints.
• Review Froxlor API access logs (if available) for listing/get calls against these command classes from unexpected sources or at unusual volume, which could indicate bulk credential harvesting.
• Treat any TOTP seed potentially exposed via these endpoints as compromised — reset/rotate 2FA for affected admin and customer accounts.
• As a precaution, rotate passwords for accounts whose data may have transited these endpoints, particularly administrator accounts.
• Longer term, consider network-level restrictions on who can reach the Froxlor API at all.

This is developing intel based solely on the GHSA advisory published 2026-08-18; no vendor patch details or exploitation-in-the-wild reports are confirmed here. See the original advisory for full technical detail and PoC: GHSA-7788-ghfq-c6mh.