Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-73311XenForo < 2.3.13 OAuth2 Authorization Code Reuse

High 7.4

In plain English

A high-severity security flaw in XenForo from XenForo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.5%top 57.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.

Affected products (as reported)

Vendor	Product	Versions
XenForo	XenForo	0 – before 2.3.13

Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Vendor Advisory vendor-advisory, patch
Release Notes release-notes
Researcher Advisory technical-description
Researcher PoC exploit
https://www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-reuse third-party-advisory