External risk intelligence

XenForo OAuth2 Authentication Bypass via Empty Secret and Code Verifier

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-73309

XenForo is a web-based forum software platform. The vulnerability exists in the OAuth2 token endpoint, which is a public-facing API service designed to be accessible over the internet to facilitate authentication for web applications and integrations.

Authentication Bypass

Xenforo

before 2.3.13

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in XenForo software, specifically within its OAuth2 token endpoint. This flaw allows unauthorized individuals to bypass authentication by submitting empty credentials, potentially leading to the compromise of token pairs. The core issue stems from how the system processes empty string inputs, which unintentionally skips critical security checks.

Bypass authentication to get valid tokens.
Affects public-facing forum software APIs.
Confirm if XenForo is used and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication to gain access to sensitive information by exploiting a flaw in XenForo's OAuth2 token endpoint. This vulnerability allows unauthenticated individuals to exchange a valid authorization code for token pairs without proper verification of their identity or the associated proof of authorization. The weakness in how the system processes empty values for secret and code verifier parameters enables this bypass.

Unauthenticated access to the OAuth2 token endpoint is required.
An attacker submits empty client secret and code verifier values.
Risk includes unauthorized token acquisition.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to obtain valid token pairs by submitting empty values for certain OAuth2 parameters. This bypasses security checks, potentially leading to unauthorized access to services integrated with the affected platform.

Valid OAuth2 token pairs.
Via empty OAuth2 parameter submission.
Unauthorized access to integrated services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in XenForo's OAuth2 token endpoint is likely to impact application owners and infrastructure teams responsible for managing the forum. The first practical step is to identify all XenForo instances, determine their exposure to the internet, confirm business criticality, and then assign ownership for remediation planning.

Application owners should own the issue.
Verify internet-facing XenForo instances.
Plan vendor coordination for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XenForo and where does it run?

XenForo is a commercial web-based forum software platform used to build online communities, discussion boards, and social platforms. It runs on web servers using PHP and typically functions as a central hub for user interaction. The vulnerable component, the OAuth2 token endpoint, is a specific server-side interface that allows external applications or services to authenticate and interact with the forum platform.

What does CWE-697 mean for CVE-2026-73309?

CWE-697 refers to insufficient comparison, which happens when software fails to correctly check if two values are equivalent. In this CVE, the software uses PHP logic that treats an empty string as false. Because of this, the code skips mandatory validation checks for the OAuth2 client secret and PKCE code verifier when an attacker provides empty inputs. Essentially, the system incorrectly concludes that the missing security data is acceptable, allowing the authentication flow to proceed.

How can an attacker trigger this authentication bypass?

An attacker triggers this by sending a specially crafted request to the OAuth2 token endpoint. By submitting empty values for the 'client_secret' and 'code_verifier' parameters, the attacker exploits the flawed logic that skips identity verification. This bug does not trigger if the application is configured to strictly enforce these parameters or if the specific OAuth2 flow being used does not rely on these inputs; however, standard OAuth2 integrations are typically designed to require them.

Do I need to worry if my XenForo instance is internet-facing?

Yes. According to Halo Surface Signal, this software component is designed to be accessible over the internet to support integrations. Because the vulnerability is reachable through a public-facing API, any XenForo site exposed to the internet can be targeted by unauthorized actors. Internal-only instances have a lower profile, but internet-facing installations are at a higher risk of being probed for this authentication bypass.

When should I start responding to this XenForo vulnerability?

You should begin by auditing your infrastructure to identify all active XenForo installations and confirming their specific version numbers. Determine which of these are accessible from the internet and evaluate their role in your environment. Once your assets are identified, coordinate with your technical teams to plan for the application update provided by the vendor, as this is the standard method for replacing the logic that currently allows the bypass.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.