CVE-2026-73309: XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for clientsecret and codeverifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
XenForo versions before 2.3.13 are affected where the OAuth2 token endpoint can be used to exchange authorization codes. Version 2.3.13 is identified as the fixed release.
What does an attacker need to exploit this issue?
An attacker needs a valid authorization code. They can submit empty client_secret and code_verifier values, causing validation of the client identity and PKCE verifier to be skipped.
What access can successful exploitation provide?
Successful exploitation allows an unauthenticated attacker to obtain a valid OAuth2 token pair. The vulnerability is rated high and impacts confidentiality and integrity, while no availability impact is specified.