VulnSocial

CVE-2026-73309Disclosure(xenforo / xenforo)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch xenforo xenforo systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment.

xenforo CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-697

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • xenforo

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
xenforo
Products
xenforo

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-09: 1Patch / Workaround · 2026-09-09: 1Technical Details · 2026-09-09: 109-09
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🔴 XenForo'da kritik OAuth2 güvenlik açıkları! XenForo'da CVE-2026-73309, CVE-2026-73311 ve CVE-2026-73312 olarak takip edilen üç önemli güvenlik açığı yayınlandı. Açıklar; OAuth2 token doğrulaması, authorization code yeniden kullanımı ve refresh token replay gibi kimlik doğrulama mekanizmalarını etkiliyor. Başarılı istismar durumunda saldırganın geçerli access/refresh token elde ederek yetkisiz erişim sağlaması mümkün olabiliyor. Açıklardan etkilenen sürümler için XenForo 2.3.13 ve üzeri sürümlere güncelleme yapılması öneriliyor. 🔴 XenForo kullanan yöneticilerin OAuth2 entegrasyonlarını ve sürümlerini kontrol etmesi mutlaka gerekli.

    Post summary

    Three newly disclosed OAuth2 vulnerabilities in XenForo (CVE-2026-73309, 73311, 73312) enable attackers to hijack tokens and gain unauthorized access, with patches available in version 2.3.13 and above.

    00032294
    2.4K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appxenforoxenforo---

Explore more

Back to dashboardxenforo CVEsxenforo vulnerabilities