CVE-2025-71279
Received Received - Intake
Authentication Bypass in XenForo Passkey Implementation Before

Publication date: 2026-04-01

Last updated on: 2026-04-01

Assigner: VulnCheck

Description
XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of Passkey-based authentication.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-01
Last Modified
2026-04-01
Generated
2026-06-16
AI Q&A
2026-04-01
EPSS Evaluated
2026-06-15
NVD
CVE-2025-71279
EUVD
EUVD-2025-209152
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
xenforo xenforo to 2.3.7 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

This vulnerability can have a severe impact by allowing unauthorized attackers to bypass Passkey authentication controls, potentially gaining access to user accounts. The impact affects confidentiality, integrity, and availability of the affected system, meaning sensitive information could be exposed, altered, or the service could be disrupted.

Compliance Impact

The provided information does not specify how CVE-2025-71279 affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate CVE-2025-71279, you should immediately upgrade XenForo to version 2.3.7 or later, as this release contains the necessary security fixes addressing the Passkey authentication vulnerability.

If a full upgrade is not immediately possible, applying the provided patch file (237-patch.zip) is recommended, though a full upgrade is preferred.

Additionally, review and refactor any database queries embedded directly within templates, as these are deprecated and will be disallowed in future releases. Errors related to this will now be logged in the server error log.

Executive Summary

CVE-2025-71279 is a critical security vulnerability affecting XenForo versions prior to 2.3.7. It involves a flaw in the Passkey-based authentication mechanism, where an attacker can bypass security controls on Passkeys added to user accounts. This means the attacker may be able to compromise the authentication process without needing any privileges or user interaction.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart