CVE-2026-73312 | BDVDB-2026-369901 Detail
XenForoXenForo
Description#
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-294 Authentication Bypass by Capture-replay
References#
- https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
- https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/
- https://bombobombone.github.io/posts/cve-2026-73312/
- https://github.com/BomboBombone/CVE-2026-73312
- https://www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-token
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.