Quick answers
- Is CVE-2026-73310 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73310 being exploited in the wild.
- How severe is CVE-2026-73310?
- Medium severity, with a CVSS score of 5.9, published 8 September 2026.
- Which products and versions are affected?
- XenForo XenForo before 2.3.13.
- Is there a fix for CVE-2026-73310?
- A patch was published on 2026-09-08: Fixed in XenForo 2.3.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73310 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-73310?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint where the authorization code is not bound to the redirect URI used during the authorization request. The server stores the redirect URI on the OAuthRequest object but only validates that the submitted redirect_uri parameter appears in the client's allowlist during token redemption, without comparing it to the URI that originally issued the code. An attacker controlling a second allowlisted redirect URI can intercept or obtain a valid authorization code issued for a different callback and redeem it using their controlled callback URI. The attack requires a valid authorization code and control of another registered callback (e.g., an abandoned endpoint or custom URI scheme), but does not require code interception or credential compromise. XenForo 2.3.13 fixes this by binding the submitted redirect URI to the authorization request that produced the code.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in XenForo 2.3.13