CVEvulnerability
CVE-2026-73312
9.1 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-09-08
- Last modified
- 2026-09-11
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 9.1 CRITICAL — CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-294
Description
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
Affected configurations
• xenforo xenforo (< 2.3.13)
Related
Weakness · CWE (1)
- CWE-294 Authentication Bypass by Capture-replay weakness
References
- https://bombobombone.github.io/posts/cve-2026-73312/ Exploit, Third Party Advisory
- https://github.com/BomboBombone/CVE-2026-73312 Exploit, Third Party Advisory
- https://www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-token Third Party Advisory
- https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/ Release Notes
- https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/ Release Notes