CVE-2026-73312: XenForo Refresh Token Replay Vulnerability

CVE-2026-73312 Overview

CVE-2026-73312 is a refresh token replay vulnerability affecting XenForo forum software versions prior to 2.3.13. The flaw allows attackers to reuse a single refresh token multiple times to generate independent OAuth token pairs. XenForo fails to mark refresh tokens as consumed when their parent access token has already expired. Attackers who obtain a refresh token can repeatedly submit it to the token endpoint, producing new access and refresh token pairs on demand. This behavior grants persistent unauthorized access for the entire lifetime of the token. The vulnerability is categorized under CWE-294: Authentication Bypass by Capture-replay.

Critical Impact
Attackers with a captured refresh token can maintain persistent access to compromised XenForo accounts by repeatedly minting new token pairs without re-authentication.

Affected Products

XenForo versions 2.2.0 through 2.3.12
XenForo Media Gallery add-on versions in the affected range
All XenForo installations exposing OAuth token refresh endpoints

Discovery Timeline

2026-09-08 - CVE-2026-73312 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-73312

Vulnerability Analysis

The vulnerability resides in XenForo's OAuth 2.0 refresh token handling logic. OAuth 2.0 requires that refresh tokens be single-use, with the server invalidating a token immediately after it is exchanged for a new access token pair. XenForo enforces this invalidation only when the associated access token remains valid at the time of the refresh request.

When the parent access token has already expired, XenForo processes the refresh request and issues a new token pair without marking the submitted refresh token as consumed. The refresh token remains reusable indefinitely until its own expiration. An attacker with access to a leaked or intercepted refresh token can wait for the parent access token to expire and then submit the same refresh token repeatedly. Each request returns a fresh access and refresh token pair.

Root Cause

The root cause is a conditional state transition in the token consumption workflow. XenForo's token endpoint checks the parent access token's validity before performing the atomic invalidation of the refresh token. Refresh tokens tied to an expired access token bypass the consumption step, breaking OAuth 2.0 single-use guarantees.

Attack Vector

Exploitation requires network access to the XenForo instance and possession of a valid refresh token. Tokens may be captured through browser storage compromise, network interception on misconfigured deployments, log exposure, or downstream integration leaks. Once obtained, the attacker submits the refresh token to the OAuth token endpoint after the parent access token expires. Repeated submissions yield independent token pairs, each providing full account access. Detailed exploitation mechanics are documented in the BomboBombone analysis of CVE-2026-73312 and the VulnCheck advisory on XenForo token replay.

Detection Methods for CVE-2026-73312

Indicators of Compromise

Multiple successful OAuth token refresh responses tied to the same refresh token identifier
Access token issuance clusters originating from a single client with abnormal cadence
Refresh requests submitted only after the parent access token expiration window
Unusual geographic or IP diversity for token refresh requests bound to a single user account

Detection Strategies

Instrument the OAuth token endpoint to log refresh token identifiers and correlate reuse across sessions
Alert on any refresh token identifier appearing in more than one successful /oauth/token grant response
Baseline expected refresh cadence per client and flag deviations exceeding normal rotation intervals
Cross-reference issued token pairs against user session records to detect orphaned access tokens

Monitoring Recommendations

Forward XenForo application logs and web server access logs to a centralized analytics platform
Retain OAuth token issuance events for at least 90 days to support retrospective hunting
Monitor for authentication anomalies such as concurrent sessions from disparate IP ranges tied to the same account

How to Mitigate CVE-2026-73312

Immediate Actions Required

Upgrade all XenForo installations to version 2.3.13 or later without delay
Revoke all outstanding OAuth refresh tokens after patching to invalidate any previously captured tokens
Force re-authentication for API clients and integrated applications following the upgrade
Audit OAuth token issuance logs for signs of repeated refresh token reuse prior to patching

Patch Information

XenForo released version 2.3.13 addressing this vulnerability. The patch enforces single-use semantics on refresh tokens regardless of the parent access token's expiration state. Details are available in the XenForo security fixes announcement and the XenForo 2.3.13 release notes.

Workarounds

Reduce refresh token lifetime configuration to shorten the window of exploitation for any captured tokens
Restrict access to the OAuth token endpoint via web application firewall rules where feasible
Disable OAuth-based API access temporarily if patching cannot be completed immediately
Rotate OAuth client secrets and revoke tokens for third-party integrations that store XenForo credentials

bash

# Configuration example - revoke outstanding tokens after upgrade
# Consult XenForo administrator documentation for the exact procedure in your deployment
php cmd.php xf:rebuild-oauth-tokens --revoke-all