Executive brief
XenForo is a popular forum and community platform that supports multi-factor authentication via passkeys (a hardware or software credential). A vulnerability in versions before 2.3.13 allows an attacker who knows a target user's password to bypass the passkey-based second authentication factor by submitting their own registered passkey instead. This could enable unauthorized access to user accounts and admin control panels if an attacker obtains a password through phishing or data compromise.
Technical details
The vulnerability is an authentication bypass in the passkey TFA provider during WebAuthn assertion verification. The passkey verification routine performs a global credential lookup by credential ID and correctly validates the WebAuthn signature, challenge, origin, and counter. However, it fails to verify that the matched credential's owner (user_id) matches the account attempting to log in. An attacker with knowledge of a target's password and possession of their own registered passkey can respond to the target's passkey challenge with their own credential, and the system will grant a session for the target account. The flaw affects both public forum login and admin control panel (ACP) login paths. XenForo 2.3.13 fixes the issue by validating that the credential owner matches the authenticating user.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in XenForo 2.3.13