CVE-2026-73314

CVE-2026-73314 XenForo before 2.3.13 fails open when a PayPal REST webhook names an unsupported signature algorithm. What happens The webhook handler maps PAYPAL-AUTH-ALGO through a small allowlist. If the value is unknown, the mapped algorithm becomes null. Instead of rejecting the request, the...