Skip to content
Threat Feed
Subscribe
high advisory

XenForo OAuth2 Authorization Code Reuse Vulnerability

XenForo versions prior to 2.3.13 contain an OAuth2 authorization code reuse vulnerability (CVE-2026-73311) that allows attackers to obtain unauthorized token pairs by submitting previously used codes.

CVE search metadata

CVE search record: CVE-2026-73311. Severity: high. CVSS: 7.4. KEV: no. Product: XenForo (< 2.3.13). Brief: XenForo OAuth2 Authorization Code Reuse Vulnerability. Brief link: https://feed.craftedsignal.io/briefs/2026-09-xenforo-oauth-reuse/

What's new

  • 1. added detection rule: Detects CVE-2026-73309 Exploitation - Empty OAuth2 Parameter Submission Sep 8, 19:46 via nvd
  • 2. added detection rule: Detects CVE-2026-73314 Exploitation - Malicious PayPal Webhook Request Sep 8, 17:42 via nvd
  • 3. added detection rule: Detect Potential SSRF via XenForo PayPal Webhook Sep 8, 15:41 via nvd

XenForo software versions prior to 2.3.13 contain a critical vulnerability in the handling of OAuth2 authorization codes, tracked as CVE-2026-73311. The application fails to properly invalidate or mark authorization codes as consumed after the initial token issuance. This oversight allows an attacker to replay a previously used authorization code to the token endpoint, bypassing the mandatory single-use security guarantee required by the OAuth2 specification. By successfully re-submitting the code, the attacker can receive an independent, unauthorized token pair for the same user and associated scopes. This vulnerability represents a significant risk to user account integrity and session security, as it facilitates unauthorized access to account data and privileges without requiring further interaction from the target user. Defenders should prioritize updating to version 2.3.13 or later to ensure compliance with OAuth2 security standards.

Impact

Successful exploitation allows attackers to gain unauthorized access to user accounts, potentially leading to full account takeover or unauthorized data exfiltration depending on the scopes associated with the leaked token. The vulnerability affects any XenForo environment utilizing the OAuth2 authorization code flow.

Recommendation

  • Upgrade all XenForo instances to version 2.3.13 or later immediately to address the underlying authorization code validation logic (CVE-2026-73311).
  • Review OAuth2 token usage logs to identify instances of duplicate authorization code submission.

Mitigations

Upgrade XenForo to version 2.3.13 or later

immediate IT Operations

CVE-2026-73311

Detection coverage 3

Detect Potential SSRF via XenForo PayPal Webhook

high

Detects exploitation attempts against CVE-2026-73315 by monitoring for suspicious POST requests to the PayPal webhook path containing potentially malicious URL parameters

sigma tactics: initial_access techniques: T1190 sources: webserver

Detects CVE-2026-73314 Exploitation - Malicious PayPal Webhook Request

high

Detects potential exploitation attempts of CVE-2026-73314 by identifying incoming webhook requests to the PayPal handler containing non-standard or unsupported 'auth_algo' values.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detects CVE-2026-73309 Exploitation - Empty OAuth2 Parameter Submission

high

Detects potential exploitation of CVE-2026-73309 by identifying POST requests to the OAuth2 token endpoint where required security parameters are missing or empty.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →