# CVE-2026-73310: XenForo OAuth2 redirect URI binding bypass

Source: https://junglewise.ai/threats/cve-2026-73310-xenforo-oauth2-redirect-uri-binding-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73310 · Severity: medium · CVSS 5.9 · Published 2026-09-08

XenForo is a popular web forum platform. The platform's OAuth2 authentication system fails to verify that an authorization code is redeemed with the same redirect URI where it was originally issued, allowing an attacker with control of an alternative registered callback to steal OAuth2 tokens from legitimate user authorization flows.

## Quick answers

**Is CVE-2026-73310 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73310 being exploited in the wild.

**How severe is CVE-2026-73310?** Medium severity, with a CVSS score of 5.9, published 8 September 2026.

**Which products and versions are affected?** XenForo XenForo before 2.3.13.

**Is there a fix for CVE-2026-73310?** A patch was published on 2026-09-08: Fixed in XenForo 2.3.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73310 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73310?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint where the authorization code is not bound to the redirect URI used during the authorization request. The server stores the redirect URI on the OAuthRequest object but only validates that the submitted redirect_uri parameter appears in the client's allowlist during token redemption, without comparing it to the URI that originally issued the code. An attacker controlling a second allowlisted redirect URI can intercept or obtain a valid authorization code issued for a different callback and redeem it using their controlled callback URI. The attack requires a valid authorization code and control of another registered callback (e.g., an abandoned endpoint or custom URI scheme), but does not require code interception or credential compromise. XenForo 2.3.13 fixes this by binding the submitted redirect URI to the authorization request that produced the code.

## Affected products

- XenForo XenForo before 2.3.13

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in XenForo 2.3.13

## References

- [https://bombobombone.github.io/posts/cve-2026-73310/](https://bombobombone.github.io/posts/cve-2026-73310/)
- [https://github.com/BomboBombone/CVE-2026-73310](https://github.com/BomboBombone/CVE-2026-73310)