CVE-2026-73313

Analyzed Analyzed - Analysis Complete

Multi-Factor Authentication Bypass in XenForo

Publication date: 2026-09-08

Last updated on: 2026-09-14

Assigner: VulnCheck

Description

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending, enabling an attacker who knows a target account's password to sign the challenge with their own passkey and bypass multi-factor authentication on both public forum and ACP login paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-14

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-73313

Affected Vendors & Products

Vendor	Product	Version / Range
xenforo	xenforo	to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-73313 is a multi-factor authentication bypass in XenForo versions before 2.3.13. It allows an attacker who knows a target user's password and has their own registered passkey to bypass MFA during login. The system fails to verify that the passkey used belongs to the account attempting to log in, enabling the attacker to complete authentication as the target user.

Detection Guidance

To detect this vulnerability, check if your XenForo instance is running a version before 2.3.13. Use the command 'composer show xenforo/xenforo' in your XenForo installation directory to verify the version. If the version is below 2.3.13, the system is vulnerable.

Impact Analysis

If you use XenForo with passkey-based MFA enabled, an attacker could gain unauthorized access to your account by exploiting this flaw. They would need your password and their own registered passkey. This could lead to data theft, account takeover, or unauthorized actions on your behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected XenForo versions may face compliance violations, legal penalties, and reputational damage due to insufficient authentication controls.

Mitigation Strategies

Immediately update XenForo to version 2.3.13 or later to patch the vulnerability. If updating is not immediately possible, disable passkey-based MFA as a temporary workaround until the update is applied.

Hi! I’m here to help you understand CVE-2026-73313. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70