CVE-2026-73319: XenForo < 2.3.13 XSS via Dynamic Redirect Handler
XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostname in the URI authority component and use percent-encoded newlines to evade server-side filters, causing authenticated users who perform a Follow action to execute attacker-supplied JavaScript in their browser.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
XenForo versions before 2.3.13 are affected. The issue is in the dynamic redirect handler.
What must an attacker do to exploit this?
An unauthenticated attacker must craft a malicious javascript: URI that embeds the board hostname in its authority component and uses percent-encoded newlines to bypass server-side filters. An authenticated user must then perform a Follow action using the attacker-controlled link or content.
What is the impact if exploitation succeeds?
Attacker-supplied JavaScript executes in the affected board's origin in the authenticated victim's browser. This can expose information available to that user and allow actions with that user's browser session context.
What version addresses the issue?
Upgrade XenForo to version 2.3.13 or later.