CVE-2026-73311

Analyzed Analyzed - Analysis Complete

OAuth2 Authorization Code Reuse in XenForo

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: VulnCheck

Description

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-73311

Affected Vendors & Products

Vendor	Product	Version / Range
xenforo	xenforo	to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

CVE-2026-73311 is an OAuth2 authorization code replay vulnerability in XenForo versions before 2.3.13. It allows attackers to reuse a valid authorization code multiple times to obtain independent access and refresh token pairs for the same user and scopes. The issue occurs because the system does not invalidate or mark authorization codes as consumed after initial token issuance.

Detection Guidance

To detect this vulnerability, check if your XenForo version is below 2.3.13. Review OAuth2 authorization code handling logs for multiple token issuances from the same code. Look for duplicate access tokens or refresh-token families for the same user.

Impact Analysis

An attacker could gain unauthorized access to user accounts by reusing a valid authorization code. This could lead to data breaches, unauthorized actions on behalf of users, or prolonged access if refresh tokens are also compromised. The impact includes potential loss of sensitive data and compromised user sessions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade XenForo to version 2.3.13 or later immediately. This version includes a fix that atomically consumes authorization codes during token issuance, preventing reuse.

Hi! I’m here to help you understand CVE-2026-73311. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70