CVE-2026-73311 XenForo CVE debrief

Who should care

Defenders responsible for XenForo installations, especially those using versions prior to 2.3.13, should assess exposure and verify the impact of this vulnerability on their systems.

Why it matters

CVE-2026-73311 is a critical OAuth2 authorization code reuse vulnerability in XenForo before 2.3.13 that allows attackers to obtain unauthorized token pairs. Defenders should prioritize verifying exposure and assessing the impact on their systems.

• Potential unauthorized access to user accounts
• Possible bypass of single-use guarantee in OAuth2 authorization code flow
• Requires verification of XenForo version and exposure
• May require updates to OAuth2 implementation

Technical summary

The vulnerability allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code, bypassing the single-use guarantee of the OAuth2 authorization code flow in XenForo before 2.3.13. This vulnerability is a critical OAuth2 authorization code reuse vulnerability that can be exploited by attackers to gain unauthorized access to user accounts and bypass security measures. The vulnerability is caused by the failure to invalidate or mark authorization codes as consumed after initial token issuance.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using XenForo versions prior to 2.3.13.

Recommended defensive actions

• Verify XenForo version and assess exposure
• Review and update OAuth2 authorization code flow implementations
• Monitor for suspicious activity related to authorization codes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. Additional information is available from third-party advisories and release notes from XenForo. The CVE record was published on 2026-09-08T14:17:25.220Z and has not been modified since then. There are no known exploit details publicly available. Defenders should verify the impact of this vulnerability on their systems, especially those using XenForo versions prior to 2.3.13. The vulnerability allows attackers to obtain unauthorized token pairs by and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.