CVE-2026-73312

XenForo before 2.3.13 fails to mark refresh tokens as consumed once their parent access token has expired, allowing the same refresh token to be replayed multiple times (CWE-294, authentication bypass by capture-replay). An attacker who has captured a refresh token can repeatedly submit it to mint additional independent access-token/refresh-token pairs, maintaining unauthorized access for the token's full lifetime. The attack is network-based and requires no privileges or user interaction, though the high attack-complexity rating reflects the need to hold a token in the exploitable (expired-parent) state. Any XenForo deployment running an affected version that issues refresh tokens for token-based authentication is exposed. A public proof-of-concept exists on GitHub, but exploitation is not yet reported in the wild: the EPSS score is 0.4% (28th percentile) and the flaw is not in CISA KEV.

What to do: Upgrade to XenForo 2.3.13 or later. Administrators who cannot patch immediately should rotate or revoke outstanding refresh tokens and review authentication logs for the same refresh token being exchanged repeatedly for new token pairs. Because exploitation presumes token capture, also check for token leakage in logs, proxies, and third-party integrations.