CVE-2026-73310 XenForo CVE debrief

Who should care

Defenders responsible for XenForo installations, especially those using versions before 2.3.13, should assess their exposure and implement measures to prevent exploitation. This includes verifying the version of XenForo in use, understanding the potential impact of the vulnerability on their systems, and taking steps to mitigate the risk. Additionally, security teams and vulnerability management teams should review the vulnerability details and assess the

Why it matters

CVE-2026-73310 is an authorization flaw in XenForo's OAuth2 token endpoint that allows attackers to bypass redirect URI binding and steal OAuth2 tokens. Defenders should prioritize verifying exposure, assessing impact, and implementing measures to prevent exploitation.

• Attackers can steal OAuth2 tokens from intercepted authorization flows
• Defenders need to verify exposure and assess impact on their systems
• Implementing redirect URI binding can prevent bypass
• Updating to XenForo version 2.3.13 or later can mitigate vulnerability

Technical summary

The CVE-2026-73310 vulnerability is an authorization flaw in XenForo's OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if they use XenForo versions before 2.3.13.

Recommended defensive actions

• Verify XenForo version and assess exposure to this vulnerability
• Implement redirect URI binding to prevent bypass
• Monitor for suspicious OAuth2 token requests
• Update to XenForo version 2.3.13 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail page provide information about this authorization flaw in XenForo's OAuth2 token endpoint. The vulnerability allows attackers to bypass redirect URI binding and steal OAuth2 tokens from intercepted authorization flows.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.