CVE Alert: CVE-2026-73311 – XenForo

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.

This is a high-priority authentication-control weakness with potentially severe confidentiality and integrity consequences, but confirmed active exploitation cannot be established because KEV, SSVC, EPSS and PoC-status data are not provided.

Successful abuse could produce additional valid access tokens for an existing user session, enabling unauthorised access to private forum content and account functions. The realistic attacker objective is account takeover or privilege abuse, followed by data theft, impersonation, fraudulent content changes or access to connected integrations. Availability impact appears limited, but trust and data-protection exposure may be substantial.

### Most likely attack path

The attack is network-based, requires no prior privileges or user interaction, and has no cross-application scope change. High attack complexity is the principal constraint: an attacker must obtain and replay a previously issued, still-usable authorisation artefact within the relevant flow. If the affected platform grants administrative or integration scopes, the resulting access could facilitate further compromise of connected services, although lateral movement is not inherent.

### Who is most exposed

Internet-facing community, support and customer portals using the platform’s OAuth features are most exposed, particularly sites with third-party sign-in, mobile applications or automation integrations. Multi-tenant deployments and forums holding sensitive member or staff information warrant earlier treatment.

Hunt for repeated token exchanges using the same authorisation-code identifier.

Correlate duplicate token grants, unusual scopes and rapid IP or user-agent changes.

Review authentication logs for anomalous access immediately after code redemption.

Alert on newly issued tokens followed by privileged profile or administrative actions.

### Mitigation and prioritisation

Apply the vendor security update promptly; prioritise internet-facing and privileged deployments.

Until patched, disable or restrict affected OAuth integrations where operationally safe.

Enforce short code lifetimes, strict redirect-URI validation and server-side single-use tracking.

Revoke existing sessions and tokens after patching if replay is suspected; record change and rollback plans.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.