CVE-2026-73310CWE-863broken-access-control

CVE-2026-73310

Medium · published September 8, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00485 · 40.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-08T18:17Z
Affected products (1)
ProductVersionsFixed in
xenforo/xenforo< 2.3.132.3.13
References (5)
https://bombobombone.github.io/posts/cve-2026-73310/ · [email protected]https://github.com/BomboBombone/CVE-2026-73310 · [email protected]https://www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-token-theft-via-redirect-uri-bypass · [email protected]https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/ · [email protected]https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/ · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 13:16Z
    XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass
    cvelistv5