CVE-2026-73312
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
- CVSS 4.0
- 9.1 CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.35% probability · 29th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-294
- Affected
- xenforo/xenforo
- Source
- disclosure@vulncheck.com
References
- https://bombobombone.github.io/posts/cve-2026-73312/Exploit, Third Party Advisory
- https://github.com/BomboBombone/CVE-2026-73312Exploit, Third Party Advisory
- https://www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-tokenThird Party Advisory
- https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/Release Notes
- https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/Release Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.