Cve-2026-73309 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-73309/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 08 Sep 2026 15:41:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgXenForo OAuth2 Authorization Code Reuse Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-09-xenforo-oauth-reuse/Tue, 08 Sep 2026 15:41:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-xenforo-oauth-reuse/XenForo versions prior to 2.3.13 contain an OAuth2 authorization code reuse vulnerability (CVE-2026-73311) that allows attackers to obtain unauthorized token pairs by submitting previously used codes.XenForo software versions prior to 2.3.13 contain a critical vulnerability in the handling of OAuth2 authorization codes, tracked as CVE-2026-73311. The application fails to properly invalidate or mark authorization codes as consumed after the initial token issuance. This oversight allows an attacker to replay a previously used authorization code to the token endpoint, bypassing the mandatory single-use security guarantee required by the OAuth2 specification. By successfully re-submitting the code, the attacker can receive an independent, unauthorized token pair for the same user and associated scopes. This vulnerability represents a significant risk to user account integrity and session security, as it facilitates unauthorized access to account data and privileges without requiring further interaction from the target user. Defenders should prioritize updating to version 2.3.13 or later to ensure compliance with OAuth2 security standards.

Impact

Successful exploitation allows attackers to gain unauthorized access to user accounts, potentially leading to full account takeover or unauthorized data exfiltration depending on the scopes associated with the leaked token. The vulnerability affects any XenForo environment utilizing the OAuth2 authorization code flow.

Recommendation

  • Upgrade all XenForo instances to version 2.3.13 or later immediately to address the underlying authorization code validation logic (CVE-2026-73311).
  • Review OAuth2 token usage logs to identify instances of duplicate authorization code submission.
]]>highadvisoryweb-applicationvulnerabilityauthentication-bypasscve-2026-73309web-application-vulnerability