Read the docs
TI-2026-51435 Aliases CVE-2026-73310GHSA-3hj9-69jw-9xx6

XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass

Priority LOW 36CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00485 42nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed XenForo (XenForo): 2.3.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XenForoXenForobefore 2.3.132.3.13Patch availableCNA
  • XenForo VendorXenForo Affected before 2.3.13 Fixed in 2.3.13 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*before 2.3.13VulnerableXenForo
  • cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:* Versions before 2.3.13 Vulnerable ·XenForo

Remediation

  • Fix · CNA XenForo (XenForo) Fixed in 2.3.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    XenForo — xenforo.com/community/threads/security-fixes-released-for-a…

    14 records Highest priority Priority HIGH 4 HIGH, 5 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-51441 XenForo < 2.3.13 Payment Replay via PayPal REST Payment ProviderPriority HIGH 77
    • TI-2026-51439 XenForo < 2.3.13 Signature Verification Bypass via PayPal REST WebhookPriority HIGH 77
    • TI-2026-51436 XenForo < 2.3.13 OAuth2 Authorization Code ReusePriority HIGH 74
    Show all 14 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73310
  2. 2026-10-03 Alias added: GHSA-3hj9-69jw-9xx6

References

Exploit 2

Patch 1

Other 1

  • TI-2026-51441 XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider CVSS 4.0HIGH 8.7
  • TI-2026-51439 XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook CVSS 4.0HIGH 8.7
  • TI-2026-51436 XenForo < 2.3.13 OAuth2 Authorization Code Reuse CVSS 4.0CRITICAL 9.1
  • TI-2026-51434 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint CVSS 4.0CRITICAL 9.1
  • TI-2024-25701 Xenforo before 2.2.16 allows code injection. CVSS 3.1HIGH 8.8
  • TI-2026-51446 XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser CVSS 4.0HIGH 7.1
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences