CVE-2025-71279
Authentication Bypass in XenForo Passkey Implementation Before
Publication date: 2026-04-01
Last updated on: 2026-04-01
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xenforo | xenforo | to 2.3.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how CVE-2025-71279 affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
This vulnerability can have a severe impact by allowing unauthorized attackers to bypass Passkey authentication controls, potentially gaining access to user accounts. The impact affects confidentiality, integrity, and availability of the affected system, meaning sensitive information could be exposed, altered, or the service could be disrupted.
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2025-71279, you should immediately upgrade XenForo to version 2.3.7 or later, as this release contains the necessary security fixes addressing the Passkey authentication vulnerability.
If a full upgrade is not immediately possible, applying the provided patch file (237-patch.zip) is recommended, though a full upgrade is preferred.
Additionally, review and refactor any database queries embedded directly within templates, as these are deprecated and will be disallowed in future releases. Errors related to this will now be logged in the server error log.
Can you explain this vulnerability to me?
CVE-2025-71279 is a critical security vulnerability affecting XenForo versions prior to 2.3.7. It involves a flaw in the Passkey-based authentication mechanism, where an attacker can bypass security controls on Passkeys added to user accounts. This means the attacker may be able to compromise the authentication process without needing any privileges or user interaction.