CVE-2026-73310 PUBLISHED

XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass

Assigner: VulnCheck
Reserved: 11.08.2026 Published: 08.09.2026 Updated: 09.09.2026

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.2

Product Status

Vendor XenForo
Product XenForo
Versions Default: unaffected
  • affected from 0 to 2.3.13 (excl.)

Credits

  • Marco Paciaroni (BomboBombone) finder
  • VulnCheck coordinator

References

Problem Types

  • Incorrect Authorization CWE