Authentication Bypass Vulnerability in XenForo by XenForo Limited
CVE-2026-73309

9.1CRITICAL

Key Information:

Vendor

Xen Projectforo

Status
Xen Projectforo
Vendor
CVE Published:
8 September 2026

What is CVE-2026-73309?

XenForo versions prior to 2.3.13 are susceptible to an authentication bypass due to a flaw in the OAuth2 token endpoint. Attackers can exploit this vulnerability by submitting empty values for critical parameters, thereby bypassing essential client secret validation and PKCE code verifier checks. This loophole allows unauthorized access to valid token pairs, enabling potential data breaches. It is crucial for users to update to the latest version to mitigate this risk.

Affected Version(s)

XenForo 0 < 2.3.13

References

https://xenforo.com/community/threads/security-fixes-rele...
vendor-advisorypatch
https://xenforo.com/community/threads/xenforo-2-3-13-and-...
release-notes
https://www.vulncheck.com/advisories/xenforo-authenticati...
third-party-advisory

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Paciaroni (BomboBombone)
VulnCheck
.