CVE-2026-73311 XenForo CVE debrief

Who should care

Defenders responsible for XenForo installations, especially those using versions prior to 2.3.13, should assess their exposure and consider upgrading to mitigate the vulnerability.

Why it matters

CVE-2026-73311 is a critical OAuth2 authorization code reuse vulnerability in XenForo before 2.3.13. Defenders should prioritize verifying exposure and assessing the impact on their systems, especially those using XenForo versions prior to 2.3.13.

• Potential unauthorized access to user accounts
• Possible bypass of single-use guarantee in OAuth2 authorization code flow
• Required verification of XenForo version and exposure
• Potential impact on user authentication and authorization

Technical summary

The vulnerability exists in XenForo versions prior to 2.3.13, where an attacker can submit a previously used authorization code to obtain an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow. This allows attackers to potentially gain unauthorized access to user accounts and bypass authentication mechanisms. The vulnerability is caused by the failure to invalidate or mark authorization codes as consumed after initial token issuance. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using XenForo versions prior to 2.3.13.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using XenForo versions prior to 2.3.13.

Recommended defensive actions

• Verify XenForo version and check for exposure
• Assess the impact of the vulnerability on your systems
• Consider upgrading to XenForo 2.3.13 or later
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE record and NVD detail page. Exploit and third-party advisories are available, but no official statement on exploitation has been made. The CVE record was published on 2026-09-08T14:17:25.220Z and has not been modified since then. The NVD detail page provides additional information on the vulnerability, including its CVSS score and severity. Defenders should verify the exposure of their XenForo installations and assess the potential impact on their systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.