by Kastro
Paper/Archive/CVE-2026-73311

CVE-2026-73311

XenForo XenForo — XenForo < 2.3.13 OAuth2 Authorization Code Reuse

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 42.6.426 × 208.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.

Affected

ProductAffectedFixed inSource
XenForo< 2.3.132.3.13CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

patchxenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856refxenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857writeupbombobombone.github.io/posts/cve-2026-73311exploitgithub.com/BomboBombone/CVE-2026-73311writeupvulncheck.com/advisories/xenforo-oauth2-authorization-code-reuse