CVE-2026-73309

🗓️ 08 Sep 2026 13:15:50Reported by VulnCheckType

Auth bypass in XenForo before 2.3.13 OAuth2 endpoint via empty client_secret and code_verifier.

Reporter	Title	Published	Views	Family All 2
Cvelist	CVE-2026-73309 XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint	8 Sep 202613:15	–	cvelist
EUVD	EUVD-2026-72780	8 Sep 202613:15	–	euvd

Vulners

Node

xenforo xenforoRange0–2.3.13

[
  {
    "defaultStatus": "unaffected",
    "vendor": "XenForo",
    "product": "XenForo",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThan": "2.3.13"
      }
    ]
  }
]

Source	Link
xenforo	www.xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/
github	www.github.com/BomboBombone/CVE-2026-73309
xenforo	www.xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
vulncheck	www.vulncheck.com/advisories/xenforo-authentication-bypass-via-oauth2-token-endpoint
bombobombone	www.bombobombone.github.io/posts/cve-2026-73309/

09 Sep 2026 17:17Current

CVSS 3.17.4

CVSS 49.1

SSVC

CWE-697