Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-73309XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint

High 7.4

In plain English

A high-severity security flaw in XenForo from XenForo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.7%top 47.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment.

Affected products (as reported)

Vendor	Product	Versions
XenForo	XenForo	0 – before 2.3.13

Weakness: CWE-697 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Vendor Advisory vendor-advisory, patch
Release Notes release-notes
Researcher Advisory technical-description
Researcher PoC exploit
https://www.vulncheck.com/advisories/xenforo-authentication-bypass-via-oauth2-token-endpoint third-party-advisory