CVE-2026-73313 XenForo CVE debrief

Who should care

Defenders responsible for XenForo instances, especially those with MFA enabled, should assess exposure and prioritize patching to prevent potential authentication bypass attacks. System administrators and security teams managing XenForo installations should be aware of this vulnerability and take immediate action to protect their systems. Additionally, developers and DevOps teams involved in maintaining and updating XenForo installations should be informed

Why it matters

CVE-2026-73313 is a high-severity vulnerability in XenForo that allows an authenticated attacker to bypass MFA using the passkey TFA provider, affecting versions prior to 2.3.13.

• An attacker with knowledge of a target account's password can bypass MFA
• The vulnerability allows for authentication bypass on both public forum and ACP login paths
• Patching is required to prevent potential authentication bypass attacks
• Verification of MFA configurations and login activity is necessary

Technical summary

The vulnerability is caused by a global credential lookup in the passkey verification path, which does not validate that the matched credential belongs to the user whose login is pending. This allows an attacker who knows a target account's password to sign the challenge with their own passkey and bypass MFA on both public forum and ACP login paths. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending, enabling an attacker who knows a target account's password to sign the challenge with their own passkey and bypass multi-factor authentication on both public forum and ACP login paths. Additionally, defenders  

Defensive priority

Defenders should prioritize patching this vulnerability, especially for XenForo instances with MFA enabled, to prevent potential authentication bypass attacks.

Recommended defensive actions

• Patch XenForo to version 2.3.13 or later
• Review and update MFA configurations
• Monitor for suspicious login activity
• Verify the integrity of user accounts and passkey credentials
• Conduct a thorough review of system logs for potential exploitation attempts
• Implement additional security measures, such as IP blocking or rate limiting, to prevent brute-force attacks
• Consider disabling passkey TFA provider until the patch is applied

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information is available from third-party advisories and exploit reports.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.