VulnSocial

CVE-2026-73311Patch(xenforo / xenforo)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch xenforo xenforo systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.

xenforo CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-294

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • xenforo

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
xenforo
Products
xenforo

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-09: 1Patch / Workaround · 2026-09-09: 1Technical Details · 2026-09-09: 109-09
Signal classification1 categories
Patch
1100.0%
Full discourse1 post
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 XenForo'da kritik OAuth2 güvenlik açıkları! XenForo'da CVE-2026-73309, CVE-2026-73311 ve CVE-2026-73312 olarak takip edilen üç önemli güvenlik açığı yayınlandı. Açıklar; OAuth2 token doğrulaması, authorization code yeniden kullanımı ve refresh token replay gibi kimlik doğrulama mekanizmalarını etkiliyor. Başarılı istismar durumunda saldırganın geçerli access/refresh token elde ederek yetkisiz erişim sağlaması mümkün olabiliyor. Açıklardan etkilenen sürümler için XenForo 2.3.13 ve üzeri sürümlere güncelleme yapılması öneriliyor. 🔴 XenForo kullanan yöneticilerin OAuth2 entegrasyonlarını ve sürümlerini kontrol etmesi mutlaka gerekli.

    Post summary

    Three new XenForo OAuth2 CVEs (CVE‑2026‑73309/73311/73312) allow token replay attacks; administrators are urged to update to XenForo 2.3.13 or later for protection.

    00032294
    2.4K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appxenforoxenforo---

Explore more

Back to dashboardxenforo CVEsxenforo vulnerabilities