Is CVE-2026-73313 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73313 being exploited in the wild.

How severe is CVE-2026-73313?

Medium severity, with a CVSS score of 6.8, published 8 September 2026.

Is there a fix for CVE-2026-73313?

A patch was published on 2026-09-08: Fixed in XenForo 2.3.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73313 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73313?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73313: XenForo passkey TFA authentication bypass

CVE-2026-73313 · Severity: medium · CVSS 6.8 · Published 2026-09-08

XenForo is a popular forum and community platform that supports multi-factor authentication via passkeys (a hardware or software credential). A vulnerability in versions before 2.3.13 allows an attacker who knows a target user's password to bypass the passkey-based second authentication factor by submitting their own registered passkey instead. This could enable unauthorized access to user accounts and admin control panels if an attacker obtains a password through phishing or data compromise.

Quick answers

Is CVE-2026-73313 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73313 being exploited in the wild.
How severe is CVE-2026-73313?: Medium severity, with a CVSS score of 6.8, published 8 September 2026.
Which products and versions are affected?: XenForo XenForo before 2.3.13.
Is there a fix for CVE-2026-73313?: A patch was published on 2026-09-08: Fixed in XenForo 2.3.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73313 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73313?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in the passkey TFA provider during WebAuthn assertion verification. The passkey verification routine performs a global credential lookup by credential ID and correctly validates the WebAuthn signature, challenge, origin, and counter. However, it fails to verify that the matched credential's owner (user_id) matches the account attempting to log in. An attacker with knowledge of a target's password and possession of their own registered passkey can respond to the target's passkey challenge with their own credential, and the system will grant a session for the target account. The flaw affects both public forum login and admin control panel (ACP) login paths. XenForo 2.3.13 fixes the issue by validating that the credential owner matches the authenticating user.

Affected products

XenForo XenForo before 2.3.13

Timeline

2026-09-08: disclosed
2026-09-08: patched: Fixed in XenForo 2.3.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.