Is CVE-2026-73311 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73311 being exploited in the wild.

How severe is CVE-2026-73311?

High severity, with a CVSS score of 7.4, published 8 September 2026.

Is there a fix for CVE-2026-73311?

A patch was published on 2026-09-08: XenForo 2.3.13 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73311 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73311?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73311: XenForo OAuth2 authorization code reuse vulnerability

CVE-2026-73311 · Severity: high · CVSS 7.4 · Published 2026-09-08

XenForo is a popular forum platform with built-in OAuth2 authentication support, allowing users to grant third-party applications access to their accounts. A vulnerability in versions before 2.3.13 allows attackers who capture a valid authorization code to redeem it multiple times, obtaining multiple independent access token pairs for the same user. This could enable account compromise or unauthorized access if an attacker intercepts the authorization code during the login flow.

Quick answers

Is CVE-2026-73311 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73311 being exploited in the wild.
How severe is CVE-2026-73311?: High severity, with a CVSS score of 7.4, published 8 September 2026.
Which products and versions are affected?: XenForo XenForo before 2.3.13.
Is there a fix for CVE-2026-73311?: A patch was published on 2026-09-08: XenForo 2.3.13 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73311 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73311?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OAuth2 authorization code reuse flaw in XenForo's token grant handler. The grantAuthorizationCode() function validates the authorization code's time-based validity and issues an access/refresh token pair, but fails to delete or mark the code as consumed after initial redemption. An attacker with a valid authorization code can submit the same code multiple times to obtain independent token families for the same user and scopes, violating the single-use guarantee of the OAuth2 authorization code flow. Race conditions allow concurrent requests to both pass validation before either completes. The attacker must have the authorization code and any required client authentication or PKCE verifier material. XenForo 2.3.13 fixes this by consuming the authorization code atomically during token issuance, including for concurrent exchanges.

Affected products

XenForo XenForo before 2.3.13

Timeline

2026-09-08: disclosed: CVE-2026-73311 published
2026-09-08: patched: XenForo 2.3.13 released with fix
2026-09-08: other: Public PoC available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.