External risk intelligence

XenForo OAuth2 Authorization Code Reuse Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-73311

XenForo is a platform specifically designed to host public-facing community forums and web services. OAuth2 authentication endpoints in web applications are exposed to the internet by design to facilitate user login and identity integration for public web traffic.

Xenforo

before 2.3.13

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in XenForo, a platform used for online communities. The issue involves how the system handles authorization codes during the OAuth2 login process, potentially allowing unauthorized access to tokens. The primary concern is to confirm if this technology is in use and if it presents a potential risk.

Authorization codes can be reused for access.
It impacts user authentication and token security.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by repeatedly submitting a previously used OAuth2 authorization code. This failure in the system allows an attacker to obtain multiple, independent token pairs for the same user and scopes, bypassing the intended single-use nature of the authorization code flow and potentially gaining unauthorized access.

Requires external network access.
Submits a reused authorization code.
Leads to unauthorized token pairs.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthorized attacker to obtain duplicate authentication tokens for a user by reusing a previously submitted authorization code. This could occur when the system fails to invalidate authorization codes after they have been used to issue tokens, potentially granting the attacker the same access as the legitimate user.

Unauthorized token pairs could be obtained.
Previously used authorization codes may be submitted.
Duplicate user access could be granted.

Operational Fix

Recommended remediation, mitigation, and detection steps

The XenForo platform's OAuth2 authorization code reuse vulnerability requires immediate attention. Platform or application owners are likely responsible for addressing this critical issue by identifying all XenForo instances, assessing their exposure and business criticality, and then coordinating remediation.

Platform or application owners should own the issue.
Verify XenForo OAuth2 implementation reachability.
Plan and execute vendor-provided security updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XenForo?

XenForo is a commercial software platform widely used to build and manage internet-based community forums and discussion boards. It provides the framework for hosting user accounts, private messaging, and content interaction, often integrating with third-party services via protocols like OAuth2 to allow users to sign in using external credentials.

What does CVE-2026-73311 mean for OAuth2 security?

This vulnerability is an improper authentication weakness, specifically categorized as CWE-294. In the OAuth2 flow, an authorization code is meant to be a single-use ticket exchanged for an access token. CVE-2026-73311 occurs because the system fails to invalidate that code after its first use, allowing an attacker to submit the same code again to illegitimately obtain additional authentication tokens.

How is this OAuth2 vulnerability triggered?

An attacker triggers this by submitting an authorization code that has already been processed by the server. It is important to note that this is not a general failure of all authentication; the bug specifically relies on the system failing to check if a code was already consumed. If the authorization code is correctly marked as expired or used immediately upon the first request, the attack path is blocked.

Is my XenForo instance at risk?

If you run an internet-facing XenForo instance, you should assume relevance. According to Halo Surface Signal, this software is designed to host public community services, meaning its OAuth2 authentication endpoints are inherently exposed to the internet to facilitate logins. This public accessibility increases the likelihood that these endpoints are reachable and could be targeted by unauthorized actors.

How do I respond to this security update?

First, identify all XenForo instances within your environment. Verify your current software version to see if it is affected, as the fix requires updating to the patched release provided by the vendor. Coordinate with your team to prioritize this update, focusing on instances that utilize OAuth2 functionality, and plan for a controlled deployment of the latest version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.