CVE-2026-73310 Overview
CVE-2026-73310 is an authorization flaw in XenForo forum software versions before 2.3.13. The vulnerability exists in the OAuth2 token endpoint, which fails to properly bind an authorization code to the redirect URI presented at authorization time. An attacker who controls any allowlisted redirect URI can exchange an intercepted authorization code by submitting a different allowlisted URI, bypassing redirect URI binding. This weakness enables OAuth2 token theft from intercepted authorization flows. The issue is classified as CWE-863: Incorrect Authorization.
Critical Impact
Attackers controlling one allowlisted OAuth2 redirect URI can steal access tokens from any intercepted authorization code, enabling account takeover across XenForo-integrated applications.
Affected Products
- XenForo versions before 2.3.13
- XenForo Media Gallery add-ons for versions 2.2.0 through 2.3.12
- OAuth2-integrated third-party applications relying on XenForo as an identity provider
Discovery Timeline
- 2026-09-08 - CVE-2026-73310 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-73310
Vulnerability Analysis
The flaw resides in how the XenForo OAuth2 token endpoint validates the redirect_uri parameter during the authorization code exchange. RFC 6749 requires the token endpoint to reject any code exchange where the presented redirect_uri does not exactly match the value supplied at the original /authorize request. XenForo instead validates the redirect_uri only against the client's allowlist of registered URIs. This weakened check allows an attacker to swap the URI at exchange time as long as the substitute is also allowlisted for the same client.
The practical impact is OAuth2 token theft. An adversary who operates one legitimate allowlisted redirect on a shared client can capture authorization codes intended for another allowlisted endpoint and redeem them at the token endpoint. Successful redemption yields a valid access token bound to the victim's account.
Root Cause
The root cause is missing per-request binding between the issued authorization code and the redirect URI recorded at authorization time. The token endpoint enforces membership in the client allowlist rather than equality with the previously bound URI, violating the specification's redirect URI verification requirement.
Attack Vector
Exploitation proceeds over the network without authentication or user interaction beyond the normal OAuth2 login flow. The attacker must control an allowlisted redirect URI for the target client and must intercept or otherwise obtain an authorization code issued for a different allowlisted URI. The attacker then posts the code to the XenForo token endpoint with their own allowlisted redirect URI, receiving tokens issued for the victim's account. Technical details are available in the BomboBombone analysis and the VulnCheck advisory.
No verified public exploit code is included here; refer to the proof-of-concept repository for reproduction details.
Detection Methods for CVE-2026-73310
Indicators of Compromise
- Token endpoint requests where the redirect_uri parameter differs from the redirect_uri used at the earlier /authorize request for the same authorization code.
- Successful token issuance events followed by API activity originating from IP addresses or user agents unrelated to the user's typical session.
- Unexpected OAuth2 client registrations or updates that add new allowlisted redirect URIs to an existing client.
Detection Strategies
- Correlate authorization and token endpoint logs by authorization code identifier to flag any mismatch between the authorization-time and exchange-time redirect_uri values.
- Alert on any OAuth2 client whose allowlist contains redirect URIs pointing to distinct origins, since these clients are the primary exploitation surface.
- Review web server access logs for POST requests to the /oauth2/token endpoint immediately followed by API calls from atypical geolocations.
Monitoring Recommendations
- Enable verbose OAuth2 audit logging on the XenForo application and forward events to a centralized SIEM for retention and correlation.
- Baseline normal token issuance patterns per client and alert on volume spikes or new source IP ranges.
- Monitor administrative changes to OAuth2 client configurations, focusing on additions to redirect URI allowlists.
How to Mitigate CVE-2026-73310
Immediate Actions Required
- Upgrade XenForo to version 2.3.13 or apply the vendor's security patch for supported branches between 2.2.0 and 2.3.12.
- Audit every OAuth2 client's redirect URI allowlist and remove URIs that are not strictly required.
- Revoke and reissue OAuth2 access and refresh tokens issued during the exposure window if suspicious token exchanges are identified.
Patch Information
XenForo published fixed builds and back-ported patches in the security fixes announcement and released XenForo 2.3.13 with security fixes. The patched token endpoint enforces exact equality between the authorization-time redirect_uri and the value supplied during code exchange, restoring RFC 6749 compliant behavior.
Workarounds
- Restrict each OAuth2 client to a single redirect URI where operationally feasible, eliminating the allowlist substitution primitive.
- Segregate first-party and third-party integrations into distinct OAuth2 clients so that no single client shares an allowlist across trust boundaries.
- Require Proof Key for Code Exchange (PKCE) for all public clients to raise the difficulty of authorization code interception.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.