CVE-2026-73309
Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in XenForo OAuth2 Token Endpoint

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: VulnCheck

Description
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-08
Last Modified
2026-09-09
Generated
2026-09-09
AI Q&A
2026-09-09
EPSS Evaluated
N/A
NVD
CVE-2026-73309

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xenforo xenforo to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

XenForo before 2.3.13 has an authentication bypass in its OAuth2 token endpoint. Unauthenticated attackers can get valid token pairs by sending empty client_secret and code_verifier parameters. PHP's truthy evaluation treats empty strings as false, skipping client secret and PKCE verifier validation. This lets attackers exchange authorization codes for tokens without proving identity or fulfilling PKCE requirements.

Detection Guidance

To detect this vulnerability, check if your XenForo instance is running a version before 2.3.13. Use the command: grep -r 'XenForo' /path/to/install | grep version. If the version is below 2.3.13, the system is vulnerable. Additionally, monitor OAuth2 token endpoint logs for empty client_secret or code_verifier parameters being accepted during token exchanges.

Impact Analysis

Attackers could gain unauthorized access to protected user data and account functions by exploiting this flaw. They could impersonate users, access sensitive information, or perform actions on behalf of users without proper authentication. Systems relying on XenForo's OAuth2 for authentication may be compromised.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, non-compliance with access controls, and failure to protect user data, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately upgrade XenForo to version 2.3.13 or later. If upgrading is not possible, apply the official patch from XenForo. Disable OAuth2 token endpoints if not in use. Review and revoke any potentially compromised tokens issued before the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73309. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart