Executive brief
XenForo is a popular forum platform with built-in OAuth2 authentication support, allowing users to grant third-party applications access to their accounts. A vulnerability in versions before 2.3.13 allows attackers who capture a valid authorization code to redeem it multiple times, obtaining multiple independent access token pairs for the same user. This could enable account compromise or unauthorized access if an attacker intercepts the authorization code during the login flow.
Technical details
The vulnerability is an OAuth2 authorization code reuse flaw in XenForo's token grant handler. The grantAuthorizationCode() function validates the authorization code's time-based validity and issues an access/refresh token pair, but fails to delete or mark the code as consumed after initial redemption. An attacker with a valid authorization code can submit the same code multiple times to obtain independent token families for the same user and scopes, violating the single-use guarantee of the OAuth2 authorization code flow. Race conditions allow concurrent requests to both pass validation before either completes. The attacker must have the authorization code and any required client authentication or PKCE verifier material. XenForo 2.3.13 fixes this by consuming the authorization code atomically during token issuance, including for concurrent exchanges.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed: CVE-2026-73311 published
- 2026-09-08: patched: XenForo 2.3.13 released with fix
- 2026-09-08: other: Public PoC available