CVE-2026-73313 XenForo CVE debrief

Who should care

System administrators and security teams responsible for XenForo installations should assess their exposure and prioritize patching to prevent potential unauthorized access to user accounts.

Why it matters

CVE-2026-73313 is a high-severity vulnerability in XenForo that allows an authenticated attacker to bypass MFA using the passkey TFA provider, potentially leading to unauthorized access to user accounts.

• An attacker can bypass MFA and gain unauthorized access to user accounts
• The vulnerability allows an attacker to sign the challenge with their own passkey, enabling them to bypass MFA on both public forum and ACP login paths
• Defenders should verify if their XenForo installation is vulnerable and prioritize patching

Technical summary

The vulnerability is caused by a global credential lookup in the passkey verification path that does not validate if the matched credential belongs to the user whose login is pending. This allows an attacker who knows a target account's password to sign the challenge with their own passkey and bypass MFA on both public forum and ACP login paths. The vulnerability affects XenForo versions prior to 2.3.13 and can be mitigated by patching to the latest version. Defenders should prioritize patching this vulnerability, especially if they are using XenForo versions prior to 2.3.13, as it allows an attacker to bypass MFA and gain unauthorized access to user accounts.

Defensive priority

Defenders should prioritize patching this vulnerability, especially if they are using XenForo versions prior to 2.3.13, as it allows an attacker to bypass MFA and gain unauthorized access to user accounts.

Recommended defensive actions

• Patch XenForo to version 2.3.13 or later
• Review and update MFA settings for all users
• Monitor for suspicious login activity
• Verify if XenForo installation is vulnerable
• Prioritize patching
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is caused by a global credential lookup in the passkey verification path that does not validate if the matched credential belongs to the user whose login is pending. This allows an attacker who knows a target account's password to sign the challenge with their own passkey and bypass MFA.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.