CVE-2026-73309

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token…

Xenforo

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client…

8. Sep 2026

Original bei Hinweis öffnen

Ausgewertete Quellen

Hinweis
https://bombobombone.github.io/posts/cve-2026-73309/
Hinweis
https://www.vulncheck.com/advisories/xenforo-authentication-bypass-via-oauth2-token-endpoint
NVD
CVE-2026-73309
GitHub
https://github.com/BomboBombone/CVE-2026-73309