CVE-2026-73311

XenForo before 2.3.13 fails to invalidate or mark OAuth2 authorization codes as consumed after they are redeemed, breaking the single-use guarantee of the OAuth2 authorization code flow (CWE-294 capture/replay). An attacker who obtains an authorization code — for example one intercepted in transit or one already used by the legitimate client — can submit it again to the token endpoint and receive an independent, valid token pair. The attacker gains API access with the same user identity and scopes as the original grant, without needing the user's credentials, consistent with the high confidentiality and integrity ratings in the CVSS 4.0 score of 9.1. The issue affects XenForo installations that operate the built-in OAuth2 authorization server (REST API/connected apps) on versions prior to 2.3.13; the high attack complexity reflects the need to possess a reusable code. No in-the-wild exploitation is known: one public proof-of-concept exists on GitHub, the flaw is not in CISA KEV, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Upgrade all XenForo instances to 2.3.13 or later, prioritizing forums that expose the REST API/OAuth2 server. Until patched, limit OAuth2 clients to trusted applications, revoke and re-issue tokens for any user whose authorization traffic could have been observed, and check token-endpoint logs for the same authorization code being redeemed more than once. Because reused codes yield independent token pairs, assume any replayed code in logs may indicate an attacker-held duplicate token.