CVE-2026-73315: XenForo PayPal SSRF Vulnerability

CVE-2026-73315 Overview

CVE-2026-73315 is a Server-Side Request Forgery (SSRF) vulnerability in XenForo forum software versions prior to 2.3.13. The flaw resides in the PayPal REST webhook handler, which accepts a crafted certificate URL supplied in webhook headers without validating the scheme, hostname, or an allowlist of trusted destinations. An unauthenticated attacker can submit a crafted POST request to the PayPal webhook callback endpoint and force the server to issue outbound HTTP requests to arbitrary destinations. This includes internal network resources such as cloud instance metadata services, enabling disclosure of Identity and Access Management (IAM) credentials or pivoting to internal services. The issue is tracked as CWE-918.

Critical Impact
Unauthenticated attackers can coerce vulnerable XenForo servers into contacting internal endpoints, including cloud metadata services, potentially exposing IAM credentials and enabling secondary internal exploitation.

Affected Products

XenForo versions 2.2.0 through 2.3.12
XenForo Media Gallery (same version range, per vendor advisory)
XenForo 2.3.13 and later contain the fix

Discovery Timeline

2026-09-08 - CVE-2026-73315 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-73315

Vulnerability Analysis

The vulnerability exists in XenForo's PayPal REST webhook handler. When PayPal delivers a webhook, the handler validates the message by fetching PayPal's signing certificate from a URL supplied in the incoming HTTP headers. XenForo trusts this URL and issues an outbound HTTP request to it without verifying that the URL points to a legitimate PayPal endpoint. Because the endpoint is unauthenticated and reachable by any remote client, an attacker only needs to send a crafted POST to the webhook callback route with a malicious certificate URL header.

Exploitation permits requests to internal-only destinations, including link-local addresses such as 169.254.169.254 used by AWS, Azure, and Google Cloud instance metadata services. Successful requests to metadata endpoints can return short-lived IAM credentials that grant control over cloud resources associated with the forum's compute instance.

Root Cause

The root cause is missing input validation on a URL parameter that is later used as the target of a server-initiated HTTP request. The handler does not enforce a scheme allowlist (for example, restricting to https), a hostname allowlist (for example, PayPal-controlled domains only), or an IP address deny list for private, loopback, and link-local ranges. This maps directly to CWE-918: Server-Side Request Forgery.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP POST request to the public PayPal webhook callback endpoint on the target XenForo installation. The request includes headers that reference an attacker-controlled or attacker-chosen certificate URL. XenForo then issues a server-side HTTP GET to that URL, which the attacker can redirect toward internal infrastructure such as cloud metadata services, internal admin panels, or unauthenticated internal APIs. Technical write-ups are available in the BomboBombone advisory and the VulnCheck XenForo SSRF Advisory.

No verified proof-of-concept code is reproduced here. Refer to the BomboBombone CVE-2026-73315 repository for reference material.

Detection Methods for CVE-2026-73315

Indicators of Compromise

Unexpected outbound HTTP requests originating from the XenForo web server process to internal RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254.
Web server access logs showing POST requests to the PayPal REST webhook callback endpoint from IP addresses that do not belong to PayPal.
Outbound requests from the XenForo host with User-Agent strings associated with the PHP HTTP client fetching non-PayPal hostnames.
Cloud audit logs showing use of instance IAM credentials from unexpected source IPs.

Detection Strategies

Alert on egress traffic from web servers to metadata service IPs (169.254.169.254, fd00:ec2::254).
Correlate PayPal webhook endpoint hits with subsequent outbound HTTP requests from the same PHP worker.
Baseline PayPal webhook source addresses and flag deliveries from non-PayPal ranges.

Monitoring Recommendations

Enable and centralize web server, PHP-FPM, and firewall egress logs from all XenForo hosts.
Monitor cloud provider audit trails (AWS CloudTrail, Azure Activity Log, GCP Audit Logs) for anomalous use of instance-role credentials.
Track new or unusual outbound destinations from forum infrastructure using network flow telemetry.

How to Mitigate CVE-2026-73315

Immediate Actions Required

Upgrade XenForo and XenForo Media Gallery to version 2.3.13 or later as announced in the XenForo security fixes thread.
Rotate any IAM credentials, API keys, or secrets that were reachable from the XenForo host's instance metadata service.
Review web and cloud logs for evidence of exploitation prior to patching.

Patch Information

XenForo released version 2.3.13 with security fixes covering this SSRF issue. Details are provided in the XenForo 2.3.13 release notes. Backported fixes for older 2.2.x and 2.3.x branches are documented in the vendor advisory. Apply the vendor-supplied patch matching your deployed version.

Workarounds

Restrict egress from XenForo hosts using host or network firewalls; deny outbound traffic to 169.254.169.254, loopback, and private ranges except where required.
On AWS, enforce Instance Metadata Service Version 2 (IMDSv2) with hop-limit=1 to block SSRF-driven metadata access from the web application.
Require PayPal webhook traffic to arrive through a reverse proxy that validates the source IP against PayPal's published ranges before reaching XenForo.
Temporarily disable the PayPal REST payment integration until patched if it is not in active use.

bash

# AWS example: enforce IMDSv2 with a hop limit of 1 on an EC2 instance
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled