Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck
CVE-2026-73310XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass
Medium 5.9
In plain English
A medium-severity incorrect authorization in XenForo from XenForo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- Vendor Advisory vendor-advisory, patch
- Release Notes release-notes
- Researcher Advisory technical-description
- Researcher PoC exploit
- https://www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-token-theft-via-redirect-uri-bypass third-party-advisory