CVE-2026-73313: XenForo Passkey MFA Bypass Vulnerability

CVE-2026-73313 Overview

CVE-2026-73313 is a multi-factor authentication (MFA) bypass vulnerability in XenForo versions before 2.3.13. The flaw resides in the passkey two-factor authentication (TFA) provider, which performs a global WebAuthn credential lookup without binding the returned credential to the pending login session. An authenticated attacker who knows a target user's password can sign the WebAuthn challenge with their own registered passkey and complete login as the victim. The bypass affects both the public forum login flow and the Administrator Control Panel (ACP) login path, making it a direct path to takeover of high-privilege accounts.

Critical Impact

An attacker with valid credentials for any account they control and knowledge of a victim's password can bypass MFA and log in as the victim, including forum administrators.

Affected Products

• XenForo forum software versions prior to 2.3.13
• XenForo passkey TFA provider (WebAuthn assertion path)
• XenForo ACP login flow protected by passkey MFA

Discovery Timeline

• 2026-09-08 - CVE-2026-73313 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-73313

Vulnerability Analysis

The vulnerability is an authorization flaw (CWE-863) in XenForo's passkey TFA provider. When a user submits their username and password, XenForo initiates a WebAuthn assertion step to satisfy the second factor. The passkey verification logic queries the credential store for the submitted credential ID and validates the signature against the associated public key. However, it never checks that the returned credential record belongs to the user whose primary authentication is pending.

Because any valid passkey signature satisfies the check, an attacker can present a passkey registered to their own account to complete the login flow of a different user. The attacker only needs the victim's password to trigger the MFA prompt, and both public forum authentication and ACP authentication are affected.

Root Cause

The root cause is a missing ownership check between the WebAuthn credential and the account being authenticated. The passkey provider treats a cryptographically valid assertion as sufficient proof, rather than verifying that the credential record maps to the user ID whose login state is in progress. This is a classic incorrect authorization pattern where identity binding between session context and credential material is not enforced.

Attack Vector

Exploitation requires two preconditions: the attacker must have knowledge of the target account's password, and the attacker must have their own account with a registered passkey on the same XenForo instance. The attacker submits the victim's username and password, receives a WebAuthn challenge, and signs it with their own authenticator. The vulnerable code path accepts the assertion and issues a session tied to the victim. The same technique works against the ACP login page, allowing hijack of administrator accounts protected only by passkey MFA. Full technical write-up is available in the Bombobombone research post and the VulnCheck Advisory on XenForo MFA Bypass.

Detection Methods for CVE-2026-73313

Indicators of Compromise

• Successful logins where the WebAuthn credential ID recorded in authentication logs does not match any credential registered to the authenticating user account.
• ACP login events immediately preceded by a passkey assertion from an unusual client, geolocation, or user-agent for that administrator.
• Password reset or email change activity on privileged accounts shortly after a passkey-backed login from an unfamiliar device.

Detection Strategies

• Review the XenForo xf_user_authenticate and TFA trust logs and cross-reference the credential ID used during login with the xf_user_tfa records for that user.
• Alert on any authentication event where the passkey credential ID is registered to a different user ID than the account that was logged in.
• Monitor ACP access logs for administrator sessions established via the passkey provider from IP addresses or devices not previously associated with that administrator.

Monitoring Recommendations

• Enable verbose authentication logging in XenForo and forward it to a centralized log platform for correlation and long-term retention.
• Track baseline patterns of passkey usage per user and flag deviations, particularly for administrator and moderator accounts.
• Correlate failed password attempts with subsequent successful MFA completions to identify credential-stuffing paired with the bypass.

How to Mitigate CVE-2026-73313

Immediate Actions Required

• Upgrade all XenForo installations to version 2.3.13 or later without delay, giving priority to internet-facing forums and instances with administrator passkeys.
• Rotate passwords for administrator and moderator accounts and invalidate all existing sessions after patching.
• Audit xf_user_tfa records and remove any suspicious or unrecognized passkey registrations, especially on privileged accounts.

Patch Information

XenForo released fixed builds addressing this issue. Details and download links are documented in the XenForo Security Fixes Released announcement and the XenForo 2.3.13 and Add-Ons Release notes. The fix enforces that the credential returned during WebAuthn assertion belongs to the user whose login is pending.

Workarounds

• If patching is not immediately possible, disable the passkey TFA provider in the admin panel and require TOTP or backup codes as the second factor.
• Restrict access to the ACP login path by IP allowlisting at the web server or WAF layer until the upgrade is applied.
• Force reauthentication and passkey re-enrollment for all administrator accounts after upgrading to 2.3.13.

# Configuration example: temporarily restrict XenForo ACP access at the nginx layer
location /admin.php {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php-fpm.sock;
}