CVE-2026-73309

XenForo before 2.3.13 contains an unauthenticated authentication bypass (CWE-697) in its OAuth2 token endpoint, rated critical (CVSS 4.0: 9.1). The flaw arises from PHP truthy evaluation: when an attacker submits empty values for the client_secret and code_verifier parameters, the empty strings are treated as false and both client-secret validation and PKCE code-verifier validation are skipped entirely. As a result, an attacker who obtains a valid authorization code (for example by intercepting it during a legitimate redirect) can exchange it for a token pair without proving client identity or honoring the PKCE commitment, gaining access and refresh tokens with the high confidentiality and integrity impact reflected in the CVSS scoring. Only XenForo deployments running versions before 2.3.13 that expose the OAuth2 token endpoint (i.e., act as OAuth2 authorization servers) are affected. No in-the-wild exploitation is documented so far: one public proof-of-concept exists on GitHub, the issue is not in CISA's KEV catalog, and EPSS assigns a 0.5% probability of exploitation within 30 days.

What to do: Upgrade to XenForo 2.3.13 or later. Until patched, add a mitigation that rejects empty client_secret and code_verifier values at the OAuth2 token endpoint (e.g., via WAF rule or code patch) and monitor for tokens issued without proper client authentication. Also review OAuth2 client configurations and recently issued tokens, and enforce strict redirect-URI and TLS hygiene, since the bypass matters most when authorization codes can be intercepted.