# CVE-2026-73312: XenForo refresh token replay vulnerability

Source: https://junglewise.ai/threats/cve-2026-73312-xenforo-refresh-token-replay-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73312 · Severity: high · CVSS 7.4 · Published 2026-09-08

XenForo is a popular forum and community platform that uses OAuth2 tokens for user authentication. A vulnerability in versions before 2.3.13 allows attackers who possess a user's refresh token to repeatedly reuse it after the associated access token expires, generating multiple valid token pairs and maintaining unauthorized access for an extended period. This could allow account takeover or data access if a refresh token is compromised.

## Quick answers

**Is CVE-2026-73312 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73312 being exploited in the wild.

**How severe is CVE-2026-73312?** High severity, with a CVSS score of 7.4, published 8 September 2026.

**Which products and versions are affected?** XenForo XenForo before 2.3.13.

**Is there a fix for CVE-2026-73312?** A patch was published on 2026-09-08: XenForo 2.3.13 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73312 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73312?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a refresh token replay flaw in XenForo's OAuth2 token refresh endpoint. When a refresh token is submitted after its parent access token has expired, the refresh endpoint creates a new token pair but then attempts to revoke the old access token. However, the revocation routine checks whether the old access token is still valid and returns early if it's expired, bypassing the revocation of the associated refresh token. This allows the original refresh token to be reused multiple times to generate independent token families. An attacker must already possess a valid refresh token (and the client secret for confidential clients); this is not a login bypass. XenForo 2.3.13 fixes this by consuming the refresh token independently of the parent access token's validity state.

## Affected products

- XenForo XenForo before 2.3.13

## Timeline

- 2026-09-08: disclosed: CVE-2026-73312 published
- 2026-09-08: patched: XenForo 2.3.13 released with fix

## References

- [https://bombobombone.github.io/posts/cve-2026-73312/](https://bombobombone.github.io/posts/cve-2026-73312/)
- [https://github.com/BomboBombone/CVE-2026-73312](https://github.com/BomboBombone/CVE-2026-73312)