CVE-2026-73310 XenForo CVE debrief

Who should care

Defenders responsible for XenForo installations, especially those using OAuth2 for authentication or authorization, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-73310 is an authorization flaw in XenForo's OAuth2 token endpoint that allows attackers to bypass redirect URI binding, potentially leading to theft of OAuth2 tokens. Defenders responsible for XenForo installations should assess exposure and prioritize verification and remediation.

• Potential theft of OAuth2 tokens from intercepted authorization flows
• Bypass of redirect URI binding, allowing unauthorized access

Technical summary

The vulnerability allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. This can be used to steal OAuth2 tokens from intercepted authorization flows. The issue arises from inadequate validation of redirect URIs during the authorization code exchange process. Attackers can exploit this by intercepting an authorization code and exchanging it for an OAuth2 token using a different, allowlisted redirect URI. This bypasses the intended security mechanism of binding the redirect URI to the authorization code, potentially leading to unauthorized access and token theft.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using XenForo for authentication or authorization.

Recommended defensive actions

• Verify XenForo version and ensure it is updated to 2.3.13 or later
• Assess exposure and potential impact on systems using XenForo for authentication or authorization
• Review and update allowlisted redirect URIs to prevent unauthorized access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information is available from third-party advisories and exploit reports.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.