Quick answers
- Is CVE-2026-73312 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73312 being exploited in the wild.
- How severe is CVE-2026-73312?
- High severity, with a CVSS score of 7.4, published 8 September 2026.
- Which products and versions are affected?
- XenForo XenForo before 2.3.13.
- Is there a fix for CVE-2026-73312?
- A patch was published on 2026-09-08: XenForo 2.3.13 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73312 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-73312?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a refresh token replay flaw in XenForo's OAuth2 token refresh endpoint. When a refresh token is submitted after its parent access token has expired, the refresh endpoint creates a new token pair but then attempts to revoke the old access token. However, the revocation routine checks whether the old access token is still valid and returns early if it's expired, bypassing the revocation of the associated refresh token. This allows the original refresh token to be reused multiple times to generate independent token families. An attacker must already possess a valid refresh token (and the client secret for confidential clients); this is not a login bypass. XenForo 2.3.13 fixes this by consuming the refresh token independently of the parent access token's validity state.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed: CVE-2026-73312 published
- 2026-09-08: patched: XenForo 2.3.13 released with fix