CVE-2026-73314: XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported authalgo header value. When the algorithm cannot be mapped to a supported hash function, the verification function incorrectly returns true instead of failing, causing the caller to treat the fabricated request as verified and process the payment event without a valid PayPal signature.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
XenForo installations running a version before 2.3.13 are affected if they use the PayPal REST webhook handler. The issue is in that handler's payment signature verification logic.
What does an attacker need to exploit this?
An attacker can send a fabricated webhook request without authentication, user interaction, or a valid PayPal signature. The request uses an unsupported auth_algo header value so the handler treats signature verification as successful.
What is the impact of a successful exploit?
The application may process a fabricated payment event as though it had been verified by PayPal. The stated impact is integrity loss; confidentiality and availability impact are not indicated.
How can I determine whether my instance is vulnerable?
Check the XenForo version and whether the installation handles PayPal REST webhooks. Versions earlier than 2.3.13 with that webhook handler are affected.