CVE-2026-73310
Awaiting Analysis Awaiting Analysis - Queue

XenForo OAuth2 Token Authorization Bypass

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: VulnCheck

Description
XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-08
Last Modified
2026-09-09
Generated
2026-09-09
AI Q&A
2026-09-09
EPSS Evaluated
N/A
NVD
CVE-2026-73310

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xenforo xenforo to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

XenForo before 2.3.13 has an authorization flaw in the OAuth2 token endpoint. Attackers controlling an allowlisted redirect URI can bypass redirect URI binding by submitting a different allowlisted URI than the one recorded during authorization. This allows them to exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.

Impact Analysis

If you use XenForo with OAuth2 authentication, attackers could steal your OAuth2 tokens by exploiting this flaw. This could lead to unauthorized access to your account or data, depending on the permissions granted to the OAuth2 token.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using XenForo must address this flaw to maintain compliance.

Mitigation Strategies

Upgrade XenForo to version 2.3.13 or later to address the authorization flaw in the OAuth2 token endpoint. Review and restrict allowlisted redirect URIs to prevent mismatched URI submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart