CVE-2026-73311: XenForo OAuth2 Auth Bypass Vulnerability

CVE-2026-73311 Overview

CVE-2026-73311 is an OAuth2 authorization code reuse vulnerability in XenForo versions prior to 2.3.13. The forum platform fails to invalidate or mark authorization codes as consumed after issuing a token pair, breaking the single-use guarantee of the OAuth2 authorization code flow. Attackers who capture or replay a previously used authorization code can obtain an independent access and refresh token pair for the same user and scopes. The flaw is classified under CWE-294: Authentication Bypass by Capture-replay and is exploitable remotely without authentication.

Critical Impact
Attackers can replay OAuth2 authorization codes to mint additional valid token pairs, bypassing single-use enforcement and gaining unauthorized access to user accounts and scoped API resources.

Affected Products

XenForo versions 2.2.0 through 2.3.12
XenForo Media Gallery (versions covered in the vendor security advisory)
OAuth2 integrations and third-party applications relying on XenForo as an identity provider

Discovery Timeline

2026-09-08 - CVE-2026-73311 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-73311

Vulnerability Analysis

The OAuth2 authorization code grant flow requires the authorization server to treat each authorization code as single-use. After the client exchanges the code for an access token and refresh token, the server must mark that code as consumed. Any subsequent presentation of the same code must be rejected, and typically all previously issued tokens tied to that code should be revoked.

XenForo before 2.3.13 does not enforce this invalidation step. When a client submits an authorization code that has already been redeemed, the token endpoint issues a fresh, independent token pair rather than returning an error. Each replay produces a new valid access and refresh token bound to the original user identity and requested scopes.

The issue is a business-logic and authentication flaw rather than a memory-safety defect. Exploitation requires the attacker to obtain an authorization code, for example through log exposure, referer leakage, a compromised client, or interception on an insecure redirect channel.

Root Cause

The root cause is missing state tracking on the OAuth2 token endpoint. XenForo issues token pairs against a valid, non-expired authorization code without checking whether that code has already been redeemed. There is no consumed flag, no atomic delete-on-use operation, and no revocation of prior tokens when the same code is replayed.

Attack Vector

The attack is network-based and requires no privileges or user interaction beyond the initial legitimate authorization flow. An attacker who observes or captures an authorization code can submit it to the /oauth2/token endpoint with the corresponding client_id, redirect_uri, and client_secret where applicable. The server responds with a valid token pair, granting the attacker independent, long-lived access to the victim's account and scopes. Because the tokens are independent of those held by the legitimate client, revoking one session does not invalidate the attacker's session. Full technical detail is available in the BomboBombone research writeup and the VulnCheck advisory on XenForo OAuth2 reuse.

Detection Methods for CVE-2026-73311

Indicators of Compromise

Multiple successful POST requests to the XenForo /oauth2/token endpoint carrying the same code parameter value
Issuance of multiple distinct access_token or refresh_token values tied to a single user and OAuth2 client within a short window
Unexpected API activity or session creation from IP addresses or user agents that differ from the original OAuth2 client

Detection Strategies

Correlate authorization code values across token endpoint request logs and alert on any code that appears in more than one successful exchange
Baseline token issuance rates per user and per client, then flag anomalous spikes in token pair creation without corresponding new authorization requests
Review OAuth2 audit logs for token pairs issued outside the expected redirect flow timing window

Monitoring Recommendations

Ingest XenForo web server and OAuth2 endpoint logs into a centralized logging platform for retention and correlation across the authorization code exchange
Monitor downstream applications consuming XenForo-issued tokens for concurrent sessions from geographically or behaviorally divergent sources
Track refresh token lineage so operators can identify token families derived from replayed authorization codes

How to Mitigate CVE-2026-73311

Immediate Actions Required

Upgrade all XenForo installations to version 2.3.13 or later as detailed in the XenForo 2.3.13 release notes
Revoke and reissue OAuth2 client secrets and invalidate outstanding refresh tokens issued by affected installations
Audit OAuth2 token issuance logs from the exposure window to identify replayed authorization codes and suspicious token pairs

Patch Information

XenForo addressed the vulnerability in version 2.3.13. Details are available in the XenForo security fixes announcement. The patch enforces single-use authorization codes and rejects any subsequent redemption attempt at the token endpoint. Administrators of Media Gallery and other add-ons should apply the corresponding updates published alongside the core release.

Workarounds

If an immediate patch is not possible, restrict access to the OAuth2 token endpoint using a reverse proxy rule that rate-limits and logs repeated code values
Shorten authorization code lifetimes on downstream integrations and require Proof Key for Code Exchange (PKCE) where the client supports it
Rotate OAuth2 client credentials and monitor for unauthorized token issuance until the patched version is deployed

bash

# Configuration example
# Verify the running XenForo version and confirm the patched release is installed
grep -R "XF::VERSION_ID" /path/to/xenforo/src/XF.php
# Expected output should reflect version 2.3.13 or later