CVE-2026-73319: XenForo XSS Vulnerability

CVE-2026-73319 Overview

CVE-2026-73319 is a cross-site scripting vulnerability [CWE-79] in XenForo forum software before version 2.3.13. The flaw resides in the dynamic redirect handler, which fails to correctly validate URI schemes and hostnames. Unauthenticated attackers can craft a malicious javascript: URI that embeds the board hostname in the authority component and uses percent-encoded newlines to bypass server-side filters. When an authenticated user performs a Follow action on a crafted link, the browser executes attacker-supplied JavaScript in the board origin. This allows session data access, action forgery on behalf of the victim, and content manipulation within the forum context.

Critical Impact
Attackers can execute arbitrary JavaScript in the browsers of authenticated XenForo users, enabling session abuse and unauthorized actions within the board origin.

Affected Products

XenForo versions 2.2.0 through 2.3.12
XenForo Media Gallery (versions in the same release train)
Fixed in XenForo 2.3.13

Discovery Timeline

2026-09-08 - CVE-2026-73319 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-73319

Vulnerability Analysis

The vulnerability exists in XenForo's dynamic redirect handler, which processes URLs used by features such as the Follow action. The handler attempts to validate that the redirect target belongs to the board origin before dispatching the browser. However, the validation logic inspects the URI's authority component to confirm the hostname without adequately restricting the URI scheme. An attacker who embeds the board hostname inside a javascript: URI authority section satisfies the host check while retaining a client-side executable scheme.

The filter also fails to normalize percent-encoded control characters. Encoded newline sequences inside the URI allow the malicious payload to bypass server-side pattern matching that expects a single-line URL. When the crafted link is rendered and followed, the browser interprets the URI as javascript: and executes the embedded script under the board's origin.

Root Cause

The root cause is improper input validation in the redirect handler. Scheme validation is performed independently from host validation, allowing dangerous schemes to pass when the authority string contains an expected hostname. Additionally, missing canonicalization of percent-encoded characters lets attackers hide payload structure from filters. The combination produces a reflected XSS sink reachable through user interaction with a crafted link.

Attack Vector

Exploitation requires an authenticated victim to click or trigger a Follow action on an attacker-supplied link. The attacker crafts a URL routed through the vulnerable redirect endpoint containing a javascript: payload with the board hostname in the authority component and percent-encoded newlines separating filter-triggering tokens. No prior authentication is required for the attacker to craft the link. See the BomboBombone analysis on CVE-2026-73319 and the VulnCheck advisory for XenForo XSS for technical detail on the bypass sequence.

// No verified exploit code is published in the enriched data.
// Refer to the linked technical references for URI construction details.

Detection Methods for CVE-2026-73319

Indicators of Compromise

Web server access logs containing redirect handler requests with javascript: schemes or percent-encoded %0a or %0d sequences in URL parameters
Referer chains showing off-site sources redirecting to internal Follow endpoints with unusual URI authority patterns
Reports from users of unexpected script execution, session anomalies, or unauthorized Follow actions

Detection Strategies

Inspect XenForo redirect parameters for URI schemes other than http and https, and flag any occurrence of javascript:, data:, or vbscript:
Detect percent-encoded newline characters (%0a, %0d) inside redirect query values, which are not required for legitimate navigation
Correlate Follow action events with immediately preceding redirect requests carrying encoded payloads

Monitoring Recommendations

Enable verbose logging on the XenForo dynamic redirect handler and forward records to a centralized analytics platform
Alert on browser Content Security Policy violation reports originating from the board domain, which can surface inline script execution attempts
Monitor administrator and moderator accounts for anomalous session activity following link interactions

How to Mitigate CVE-2026-73319

Immediate Actions Required

Upgrade XenForo to version 2.3.13 or later, which contains the vendor fix for this XSS
Apply the security fix packages published in the XenForo security fixes announcement for supported branches
Notify forum moderators and administrators to avoid clicking untrusted links until the patch is applied

Patch Information

XenForo released patched builds documented in the XenForo 2.3.13 release notes. The vendor also issued security fix packages for older 2.2.0 through 2.3.12 branches to remediate installations that cannot upgrade to the latest minor release. Administrators should validate the upgrade by testing the redirect handler against javascript: URIs after deployment.

Workarounds

Deploy a Content Security Policy that disallows inline script execution and restricts script sources to trusted origins, limiting XSS payload impact
Add a web application firewall rule that blocks redirect parameters containing javascript:, data:, or percent-encoded newline characters
Restrict the redirect endpoint to strict allow-listed hostnames and reject any URI whose scheme is not http or https

bash

# Example WAF rule concept for blocking dangerous redirect payloads
# Reject requests to redirect endpoints containing javascript: or encoded newlines
SecRule REQUEST_URI "@rx (?i)(javascript:|data:|vbscript:|%0a|%0d)" \
    "id:1073319,phase:2,deny,status:403,msg:'CVE-2026-73319 XenForo redirect XSS attempt'"