CVE-2026-100719
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 26, 2026
Vendor
unknown
Description
Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure of reused credentials.