Back Redpacketsecurity

CVE Alert: CVE-2026-73309 – XenForo

Redpacketsecurity •admin • September 8, 2026

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment.

Most likely attack path

Review token-endpoint requests containing empty client-secret or verifier fields.

Correlate unusual authorisation-code exchanges, new tokens and rapid privileged actions.

Alert on anomalous OAuth clients, IPs, user agents and geographic changes.

Audit recent administrator, account and content modifications.

Mitigation and prioritisation

Apply the vendor security update promptly across core software and add-ons.

Until patched, restrict the endpoint or disable affected OAuth2 integrations where feasible.

Revoke potentially exposed tokens and review privileged accounts.

Confirm backups and test the change in staging; no KEV, SSVC or EPSS assessment is supplied.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple OAuth Vulnerabilities Discovered in XenForo XenForo versions prior to 2.3.13 are affected by three critical vulnerabilities: CVE-2026-73311, CVE-2026-73312, and CVE-2026-73309. These vulnerabilities include an OAuth2 authorization code reuse flaw, a refresh token replay issue, and an authentication bypass vulnerability, respectively. Attackers can exploit these weaknesses to gain unauthorized access to user accounts, potentially leading to account takeovers and data theft. The vulnerabilities are network-based and require no prior user interaction, making them particularly dangerous for internet-facing community and support portals. Although the vulnerabilities have been disclosed, there is currently no evidence of active exploitation. Administrators are advised to apply the vendor's security updates promptly and review their OAuth integrations for potential misuse. The vulnerabilities were published on 2026-09-08. 4 sources 58

Extracted Entities

CVE Alert: CVE-2026-73309 – XenForo

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)