CVE-2026-73312CWE-294

CVE-2026-73312

High · published September 8, 2026

CVSS v3.1

7.4

EPSS

Percentile

40.0

In the wild

Unconfirmed

What it is

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.

The record

Technical detail

CVSS v3.1: 7.4 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: 9.1 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00474 · 40.0th percentile
Weakness: CWE-294 · Authentication Bypass by Capture-replay
Published: 2026-09-08T18:17Z

Affected products (1)

Product	Versions	Fixed in
xenforo/xenforo	< 2.3.13	2.3.13

References (5)

https://bombobombone.github.io/posts/cve-2026-73312/ · [email protected]https://github.com/BomboBombone/CVE-2026-73312 · [email protected]https://www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-token · [email protected]https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/ · [email protected]https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/ · [email protected]

EPSS history

Timeline

10 SEP 03:18Z
EPSS moved — → 0%
epss
08 SEP 13:16Z
XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
cvelistv5