---
id: CVE-2026-73312
title: >-
  XenForo before 2.3.13 contains a refresh token replay vulnerability that
  allows attackers to reuse a refresh token multiple times by exploiting the
  failure to mark tokens as consumed when the parent access token has expired
summary: >-
  XenForo before 2.3.13 contains a refresh token replay vulnerability that
  allows attackers to reuse a refresh token multiple times by exploiting the
  failure to mark tokens as consumed when the parent access token has expired.
  Attackers ca…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-294
vendor: xenforo
product: xenforo
affected:
  - xenforo < 2.3.13
patched:
  - xenforo 2.3.13
published: '2026-09-08'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T20:30:57.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73312'
references:
  - url: 'https://bombobombone.github.io/posts/cve-2026-73312/'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/BomboBombone/CVE-2026-73312'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-token
    label: disclosure@vulncheck.com
  - url: >-
      https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
    label: disclosure@vulncheck.com
  - url: >-
      https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00474
epssPercentile: 0.38422
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/BomboBombone/CVE-2026-73312'
  checkedAt: '2026-09-26T09:05:58.806Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-08T13:58:39.965314Z'
ingestedAt: '2026-09-08T15:33:26.984Z'
---

## Overview

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.

## Affected

- `xenforo < 2.3.13`

## Remediation

Upgrade past the affected range:

- `xenforo 2.3.13`