Multiple Vulnerabilities Discovered in Xenforo OAuth2 Implementation

On September 8, 2026, multiple vulnerabilities were reported in Xenforo's OAuth2 implementation, affecting various systems that utilize this framework. The vulnerabilities include an authentication bypass via the OAuth2 token endpoint, authorization code reuse, signature verification bypass through PayPal REST webhook, refresh token replay using expired access tokens, and SSRF via PayPal REST webhook handler. These vulnerabilities could allow unauthorized access and manipulation of user data. No specific CVEs were mentioned in the articles, but the vulnerabilities are critical for organizations using Xenforo. The impact could be widespread, affecting numerous websites and applications that rely on Xenforo for user authentication and payment processing. The current status indicates that these vulnerabilities have been disclosed but may not yet have patches available. Security professionals are advised to prioritize remediation efforts.

Key Points: • Five critical vulnerabilities identified in Xenforo's OAuth2 implementation. • Vulnerabilities include authentication bypass and authorization code reuse. • Immediate action is recommended for organizations using Xenforo.