CVEvulnerability
CVE-2026-73311
9.1 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-09-08
- Last modified
- 2026-09-11
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 9.1 CRITICAL — CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-294
Description
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.
Affected configurations
• xenforo xenforo (< 2.3.13)
Related
Weakness · CWE (1)
- CWE-294 Authentication Bypass by Capture-replay weakness
References
- https://bombobombone.github.io/posts/cve-2026-73311/ Exploit, Third Party Advisory
- https://github.com/BomboBombone/CVE-2026-73311 Exploit, Third Party Advisory
- https://www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-reuse Third Party Advisory
- https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/ Release Notes
- https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/ Release Notes