CVE-2026-73310

🗓️ 08 Sep 2026 13:16:14Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 27 Views🌐 WEB

XenForo before 2.3.13 OAuth2 token theft via redirect URI binding bypass.

Reporter	Title	Published	Views	Family All 9
GithubExploit	Exploit for CVE-2026-73310	8 Sep 202616:35	–	githubexploit
Circl	CVE-2026-73310	13 Sep 202620:07	–	circl
Cvelist	CVE-2026-73310 XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass	8 Sep 202613:16	–	cvelist
EUVD	EUVD-2026-72781	8 Sep 202613:16	–	euvd
Kitploit	CVE-2026-73310	20 Oct 202614:16	–	kitploit
NVD	CVE-2026-73310	8 Sep 202614:17	–	nvd
Positive Technologies	PT-2026-87055	8 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-73310: Incorrect Authorization	8 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-73310 XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass	8 Sep 202613:16	–	vulnrichment

NVD

Vulners

CNA

Node

xenforo xenforoRange<2.3.13

[
  {
    "defaultStatus": "unaffected",
    "vendor": "XenForo",
    "product": "XenForo",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThan": "2.3.13"
      }
    ]
  }
]

Source	Link
xenforo	www.xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
bombobombone	www.bombobombone.github.io/posts/cve-2026-73310/
vulncheck	www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-token-theft-via-redirect-uri-bypass
xenforo	www.xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/
github	www.github.com/BomboBombone/CVE-2026-73310

Parameter	Position	Path	Description	CWE
Authorization	header	/api/me	OAuth2 token binding flaw allows a token obtained via one redirect_uri to be used against a different allowlisted redirect_uri to access resources (e.g., /api/me).	CWE-863

01 Oct 2026 15:20Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.9

CVSS 48.2

EPSS0.00485

SSVC

CWE-863