Executive brief
XenForo is a community forum platform used to host discussion boards. A cross-site scripting vulnerability in its redirect handler allows an attacker to trick authenticated users into executing malicious JavaScript within the forum's origin by crafting a specially formatted link. When a user clicks the attacker's link and confirms a "Follow" action, arbitrary JavaScript runs with access to their session and account data.
Technical details
The vulnerability exists in XenForo's dynamic redirect validation logic, which fails to restrict URI schemes when validating same-host redirects. An attacker can craft a javascript: URI (e.g., javascript://board.example/%0Awindow.name='marker';void 0) that bypasses host validation by embedding the target hostname in the URI authority component and using percent-encoded newlines (%0A) to evade filters. The validator uses PHP's URL parser to extract the host but does not check the scheme, allowing the malicious URI to pass. When an authenticated user visits the crafted Follow confirmation link and confirms the action, the browser executes the JavaScript payload in the XenForo origin with the user's privileges. Attack requires user interaction (clicking the link and confirming) but no attacker account. XenForo 2.3.13 fixed this by restricting accepted URI schemes in the redirect handler.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: XenForo 2.3.13 released with fix