CVE-2026-73310

XenForo before 2.3.13 fails to correctly enforce redirect URI binding in its OAuth2 token endpoint (CWE-863, incorrect authorization): when an authorization code is redeemed, the endpoint accepts a redirect URI other than the one recorded at authorization time, as long as both URIs are on the client's allowlist. An attacker who can intercept an authorization code and controls, or can use, any allowlisted redirect URI can redeem the code with that mismatched URI and obtain the victim's OAuth2 tokens. The impact is high on confidentiality (CVSS 4.0: 8.2) because the stolen tokens grant API access as the authorizing user, though the attack requires a relatively high-complexity interception scenario and does not affect data integrity or availability. Any XenForo deployment running a version before 2.3.13 that acts as an OAuth2 provider with allowlisted redirect URIs is affected. No in-the-wild exploitation is currently documented (EPSS 0.4%, not in CISA KEV), but a public proof of concept exists on GitHub.

What to do: Upgrade XenForo to version 2.3.13 or later. Until patched, audit OAuth2 clients and restrict each to a single allowlisted redirect URI, and consider revoking and re-issuing OAuth2 tokens for clients with multiple allowlisted URIs if code interception is suspected. Monitor token-endpoint activity for authorization codes redeemed with a redirect URI different from the one used in the original authorization request.