by Kastro
Paper/Archive/CVE-2026-73312

CVE-2026-73312

XenForo XenForo — XenForo < 2.3.13 Refresh Token Replay via Expired Access Token

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 41.0.410 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.

Affected

ProductAffectedFixed inSource
XenForo< 2.3.132.3.13CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchxenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856refxenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857writeupbombobombone.github.io/posts/cve-2026-73312exploitgithub.com/BomboBombone/CVE-2026-73312writeupvulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-token