External risk intelligence

XenForo Refresh Token Replay Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-73312

XenForo is a public-facing forum software platform. As a web application designed to be accessed by users over the internet, its authentication and token management services are inherently internet-facing and exposed by design in normal deployment.

Xenforo

before 2.3.13

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in XenForo software allows attackers to repeatedly reuse a refresh token to gain persistent unauthorized access. This occurs because the system fails to properly mark tokens as consumed after the associated access token expires, enabling attackers to generate new, independent token pairs.

Reused tokens grant lasting unauthorized access.
Critical for protecting user accounts and data.
Confirm if XenForo is used and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could gain persistent unauthorized access by exploiting a vulnerability in XenForo's token handling. This occurs when an expired access token's refresh token is not properly marked as consumed, allowing an attacker to repeatedly use it to generate new, independent tokens. This effectively grants them continued access for the duration the original token was valid.

No authentication required to access.
Reusable refresh token after access token expiry.
Achieve persistent unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

A refresh token replay vulnerability in XenForo could allow attackers to repeatedly generate new authentication tokens by exploiting the failure to properly invalidate refresh tokens after their associated access tokens expire. This could lead to persistent unauthorized access for the duration of the refresh token's validity, when supported by the advisory.

User session data could be at risk.
Attackers could replay expired refresh tokens.
Persistent unauthorized access may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in XenForo affects how refresh tokens are managed after access tokens expire, potentially allowing attackers to gain persistent unauthorized access. Identifying where XenForo is deployed, assessing its reachability and business criticality, and confirming the accountable owner are the first crucial steps to planning remediation.

Platform or application owners should lead remediation.
Verify XenForo deployment reachability and criticality.
Plan maintenance for token replay vulnerability fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XenForo?

XenForo is a commercial forum software platform used to build online communities and discussion boards. It manages user sessions, profiles, and content interactions, relying on authentication systems like OAuth 2.0 to handle user logins securely.

What is the refresh token replay issue in CVE-2026-73312?

This is a CWE-294 weakness involving improper authentication. In XenForo, the system fails to mark a refresh token as consumed if the primary access token has already expired. Because the system doesn't invalidate the refresh token after one use in this specific state, an attacker can replay it multiple times to continuously generate new, valid authentication sessions.

How can an attacker trigger this vulnerability?

An attacker needs to obtain a valid refresh token. The flaw is triggered by submitting that refresh token to the authentication service after the original access token has expired. It is not triggered by normal, single-use token exchanges where the access token is still active, nor does it affect password-based authentication flows directly.

Why is this CVE considered relevant to my environment?

According to Halo Surface Signal, XenForo is designed as a public-facing web application. Since its authentication services are inherently exposed to the internet to allow user access, this vulnerability is highly relevant because an attacker can attempt these token replays remotely without needing prior authorization.

What should I do if I run XenForo?

Prioritize identifying all instances of XenForo within your network and confirm their version numbers. Coordinate with your application owners to plan an update to version 2.3.13 or later, which contains the necessary security fixes for token management. Verify the reachability of your installations to help gauge the urgency of your maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.