VulnerabilityAnalyzed

CVE-2026-73309

CRITICAL 9.1EPSS 0.69%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.69%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment.

CVSS 4.0: 9.1 CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.69% probability · 52th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-697
Affected: xenforo/xenforo
Source: disclosure@vulncheck.com

EPSS trend

EPSS 0.7% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

https://bombobombone.github.io/posts/cve-2026-73309/Exploit, Third Party Advisory
https://github.com/BomboBombone/CVE-2026-73309Third Party Advisory
https://www.vulncheck.com/advisories/xenforo-authentication-bypass-via-oauth2-token-endpointThird Party Advisory
https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/Release Notes
https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/Release Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.