CVE-2026-73314

Analyzed Analyzed - Analysis Complete

XenForo PayPal Webhook Signature Bypass

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: VulnCheck

Description

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. When the algorithm cannot be mapped to a supported hash function, the verification function incorrectly returns true instead of failing, causing the caller to treat the fabricated request as verified and process the payment event without a valid PayPal signature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-73314

Affected Vendors & Products

Vendor	Product	Version / Range
xenforo	xenforo	to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-754	The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

Executive Summary

This vulnerability affects XenForo versions before 2.3.13. It involves a flaw in the PayPal REST webhook signature verification process. When an unsupported algorithm is provided in the PAYPAL-AUTH-ALGO header, the verification function incorrectly returns true instead of failing. This allows attackers to bypass signature validation and process fabricated webhook events as legitimate.

Detection Guidance

To detect this vulnerability, check if your XenForo version is below 2.3.13. Inspect PayPal webhook logs for requests with unsupported auth_algo headers. Look for logs where the algorithm is mapped to null and verification incorrectly returns true. Use network monitoring to identify spoofed PAYMENT.CAPTURE.COMPLETED callbacks with manipulated purchase keys or amounts.

Impact Analysis

An attacker could exploit this to forge PayPal webhook events, such as triggering unauthorized recurring user upgrades or extending subscriptions without valid payment verification. This could lead to financial losses or unauthorized access to premium features.

Mitigation Strategies

Immediately upgrade XenForo to version 2.3.13 or later to address the signature verification flaw. Disable PayPal REST webhooks if not in use. Review recent webhook events for unauthorized actions like recurring user upgrades. Implement strict input validation for auth_algo headers to reject unsupported algorithms.

Hi! I’m here to help you understand CVE-2026-73314. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70