Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-73312XenForo < 2.3.13 Refresh Token Replay via Expired Access Token

High 7.4

In plain English

A high-severity security flaw in XenForo from XenForo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.5%top 58.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.

Affected products (as reported)

Vendor	Product	Versions
XenForo	XenForo	0 – before 2.3.13

Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Vendor Advisory vendor-advisory, patch
Release Notes release-notes
Researcher Advisory technical-description
Researcher PoC exploit
https://www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-token third-party-advisory