CVE-2025-71278: XenForo OAuth2 Unauthorized Scope Request
XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71278?
CVE-2025-71278 is considered a high severity vulnerability, as it allows OAuth2 client applications to request unauthorized scopes.
How do I fix CVE-2025-71278?
To fix CVE-2025-71278, update your XenForo installation to version 2.3.5 or later.
Who is affected by CVE-2025-71278?
Any customer using OAuth2 clients on XenForo versions 2.3.0 to 2.3.4 is affected by CVE-2025-71278.
What versions of XenForo are vulnerable to CVE-2025-71278?
XenForo versions 2.3.0 to 2.3.4 are vulnerable to CVE-2025-71278.
What kind of access can be gained through CVE-2025-71278?
CVE-2025-71278 potentially allows unauthorized client applications to access user data beyond their intended scope.