Xenforo Refresh Token Replay Via Expired Access Token

Back www.vulncheck.com

Xenforo Refresh Token Replay Via Expired Access Token

www.vulncheck.com • September 8, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Xenforo OAuth2 Implementation On September 8, 2026, multiple vulnerabilities were reported in Xenforo's OAuth2 implementation, affecting various systems that utilize this framework. The vulnerabilities include an authentication bypass via the OAuth2 token endpoint, authorization code reuse, signature verification bypass through PayPal REST webhook, refresh token replay using expired access tokens, and SSRF via PayPal REST webhook handler. These vulnerabilities could allow unauthorized access and manipulation of user data. No specific CVEs were mentioned in the articles, but the vulnerabilities are critical for organizations using Xenforo. The impact could be widespread, affecting numerous websites and applications that rely on Xenforo for user authentication and payment processing. The current status indicates that these vulnerabilities have been disclosed but may not yet have patches available. Security professionals are advised to prioritize remediation efforts. 62

Extracted Entities

Platforms (1)

Vulnerabilities (1)

Refresh Token Replay Via Expired Access Token Vulnerability