CVE-2026-55593

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions. This issue is fixed in version 2.3.8.

• CWE-352

• https://github.com/froxlor/froxlor/commit/5f540fe361e7e13e8c5a32805b793a25e9e26a0e
• https://github.com/froxlor/froxlor/releases/tag/2.3.8
• https://github.com/froxlor/froxlor/security/advisories/GHSA-xpr4-8vp6-c87j

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55586SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…6.6
• CVE-2026-55588ORAS (OCI Registry As Storage) is a CLI and library for mana…6.5
• CVE-2026-5559A vulnerability has been found in AntaresMugisho PyBlade 0.1…6.3
• CVE-2026-55590CakePHP Authentication is an authentication plugin for CakeP…6.1
• CVE-2026-55591Signal K Server is a server application that runs on a centr…5.8
• CVE-2026-55592Dashy is a self-hostable personal dashboard. Prior to 4.3.7,…3.9
• CVE-2026-55594ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-55595ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-55596Plate is a rich-text editor with AI and shadcn/ui. From 53.0…8.7
• CVE-2026-55597ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55599phpseclib is a PHP secure communications library. From 0.1.1…5.8
• CVE-2026-5560A vulnerability was found in PHPGurukul Online Shopping Port…6.3