VulnSocial

CVE-2026-73312Patch(xenforo / xenforo)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch xenforo xenforo systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.

xenforo CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-294

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • xenforo

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
xenforo
Products
xenforo

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-09: 1Patch / Workaround · 2026-09-09: 1Technical Details · 2026-09-09: 109-09
Signal classification1 categories
Patch
1100.0%
Full discourse1 post
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 XenForo'da kritik OAuth2 güvenlik açıkları! XenForo'da CVE-2026-73309, CVE-2026-73311 ve CVE-2026-73312 olarak takip edilen üç önemli güvenlik açığı yayınlandı. Açıklar; OAuth2 token doğrulaması, authorization code yeniden kullanımı ve refresh token replay gibi kimlik doğrulama mekanizmalarını etkiliyor. Başarılı istismar durumunda saldırganın geçerli access/refresh token elde ederek yetkisiz erişim sağlaması mümkün olabiliyor. Açıklardan etkilenen sürümler için XenForo 2.3.13 ve üzeri sürümlere güncelleme yapılması öneriliyor. 🔴 XenForo kullanan yöneticilerin OAuth2 entegrasyonlarını ve sürümlerini kontrol etmesi mutlaka gerekli.

    Post summary

    The post discloses three OAuth2-related CVEs in XenForo, outlines how they could be abused via token reuse, and advises users to upgrade to version 2.3.13 or newer to mitigate the risk.

    00032294
    2.4K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appxenforoxenforo---

Explore more

Back to dashboardxenforo CVEsxenforo vulnerabilities