Security Issue in XenForo Affects User Passkey Authentication
CVE-2025-71279

9.3CRITICAL

Key Information:

Vendor

Xen Projectforo

Status
Xen Projectforo
Vendor
CVE Published:
1 April 2026

What is CVE-2025-71279?

A security issue in XenForo prior to version 2.3.7 compromises Passkeys linked to user accounts, potentially allowing unauthorized access to systems relying on Passkey-based authentication. This vulnerability necessitates immediate attention to safeguard user data and maintain secure authentication practices. Users are advised to upgrade to the latest version for enhanced security.

Affected Version(s)

XenForo 2.3.0 < 2.3.7

References

https://xenforo.com/community/threads/xenforo-2-3-7-relea...
vendor-advisorypatch
https://www.vulncheck.com/advisories/xenforo-passkey-secu...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jai Niresh J
Hypixel Inc.
.