CVE-2026-73312: XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
XenForo versions before 2.3.13 are affected. The provided information does not identify any configuration prerequisite or narrower affected deployment type.
What does an attacker need to exploit this issue?
An attacker needs a refresh token associated with an expired parent access token. They can repeatedly submit that same refresh token because it is not marked as consumed after use in this condition.
What is the impact of successful exploitation?
The attacker can generate multiple independent token pairs from the same refresh token, enabling persistent unauthorized access for the refresh token's full lifetime.
What version addresses the issue?
Upgrade XenForo to version 2.3.13 or later. The provided data does not specify an alternative mitigation for environments that cannot immediately upgrade.