CVE-2026-73310
XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass
- State
- Published
- Severity
- 8.2 High
- Published
- Sep 8, 2026
- Updated
- Oct 1, 2026
- Reserved
- Aug 11, 2026
Description
XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
XenForoXenForo |
|
References
- Vendor Advisoryvendor-advisorypatch
- Release Notesrelease-notes
- Researcher Advisorytechnical-description
- Researcher PoCexploit
- https://www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-token-theft-via-redirect-uri-bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.