CVE-2026-73311: XenForo < 2.3.13 OAuth2 Authorization Code Reuse
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
XenForo versions before 2.3.13 are affected. The issue applies to OAuth2 authorization-code handling where an authorization code can be submitted again after token issuance.
What does an attacker need to exploit this issue?
An attacker needs a previously used OAuth2 authorization code. No privileges or user interaction are required according to the supplied severity vector, but exploitation has high attack complexity.
What is the impact of successfully reusing an authorization code?
A successful attacker can obtain an independent OAuth2 token pair for the same user and scopes associated with the reused code. This can result in high confidentiality and integrity impact, without an indicated availability impact.
How can I determine whether my instance is vulnerable?
Check the XenForo version in use. Instances running a version earlier than 2.3.13 should be considered affected.