---
id: CVE-2026-73311
title: >-
  XenForo before 2.3.13 contains an OAuth2 authorization code reuse
  vulnerability that allows attackers to obtain unauthorized token pairs by
  submitting a previously used authorization code
summary: >-
  XenForo before 2.3.13 contains an OAuth2 authorization code reuse
  vulnerability that allows attackers to obtain unauthorized token pairs by
  submitting a previously used authorization code. Attackers can exploit the
  failure to invalidate …
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-294
vendor: xenforo
product: xenforo
affected:
  - xenforo < 2.3.13
patched:
  - xenforo 2.3.13
published: '2026-09-08'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T20:30:43.397'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73311'
references:
  - url: 'https://bombobombone.github.io/posts/cve-2026-73311/'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/BomboBombone/CVE-2026-73311'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-reuse
    label: disclosure@vulncheck.com
  - url: >-
      https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
    label: disclosure@vulncheck.com
  - url: >-
      https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00498
epssPercentile: 0.40118
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/BomboBombone/CVE-2026-73311'
  checkedAt: '2026-09-26T09:05:58.805Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T13:50:38.303534Z'
ingestedAt: '2026-09-08T15:33:26.984Z'
---

## Overview

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.

## Affected

- `xenforo < 2.3.13`

## Remediation

Upgrade past the affected range:

- `xenforo 2.3.13`