CVE-2026-73313

CVE-2026-73313: Passkey credential not bound to login account XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user. What happens The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies...

CVE-2026-73315

CVE-2026-73315: SSRF through PayPal certificate URL XenForo before 2.3.13 fetches the certificate URL supplied by a PayPal REST webhook without restricting its destination. What happens The callback handler passes PAYPAL-CERT-URL to XenForo's trusted HTTP reader. It does not require a PayPal...

CVE-2026-73319

CVE-2026-73319: JavaScript URI accepted as a dynamic redirect XenForo before 2.3.13 accepts a same-host javascript: URI as a dynamic redirect and later assigns it to window.location. What happens Server-side redirect validation rejects foreign hosts but does not require HTTP or HTTPS. A URL shape...

CVE-2026-73309

CVE-2026-73309 XenForo before 2.3.13 can skip OAuth2 client-secret and PKCE verification when an empty string reaches the token endpoint. What happens The endpoint checks whether clientsecret and codeverifier keys exist, then performs the comparisons only when their PHP string values are truthy. ...

CVE-2026-73317

CVE-2026-73317 XenForo before 2.3.13 lets an administrator with only the cache-rebuild permission dispatch an approval job as another user. What happens The ACP rebuild endpoint accepts a caller-supplied job class and options. Its authorization check asks only whether the chosen job declares itse...

CVE-2026-73318

CVE-2026-73318 XenForo before 2.3.13 lets any ACP administrator trigger site-wide privacy-policy and terms re-agreement. What happens The ACP navigation entries are limited to administrators with the option permission, but ForceAgreementController does not enforce that permission. Direct requests...

CVE-2021-43032

CVE-2021-43032 In XenForo ≤ 2.2.7, a threat actor with access to the admin panel can save cross-site scripting payloads in any function within the application that accepts HTML code. A payload placed within the 'Advertising' functionality will execute globally on the client side, allowing for...

CVE-2026-73310

CVE-2026-73310 XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued. What happens At the token endpoint, XenForo checks that the submitted redirecturi is somewhere in the client's allowlist. It does not compare the value with the...

CVE-2026-73311

CVE-2026-73311 XenForo 2.3.13 之前的版本允许 OAuth2 授权码被多次兑换。 发生了什么 授权码授权流程会加载一个授权码，验证其基于时间的有效性，并创建一对令牌。成功路径不会删除该授权码、将其标记为已使用，也不会使用原子性的一次性更新。因此，重放相同的有效交换会为同一用户和作用域创建独立的访问/刷新令牌族。 攻击者仍然需要有效的授权码以及该授权流程所需的客户端参数。此问题并不说明授权码是如何获取的；它只是使授权码在预期客户端已兑换之后仍可重复使用。 在 XenForo 2.3.12（构建版本...

CVE-2026-73312

CVE-2026-73312 XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the replacement token family, then asks the parent...

CVE-2026-73321

CVE-2026-73321 XenForo before 2.3.13 can exhaust a PHP worker through deeply nested BBCode. What I validated The public editor/to-html route sends guest-supplied BBCode through XenForo's recursive parser and renderer. It does not apply a raw-length or nesting limit before that work. The normal...

CVE-2026-73314

CVE-2026-73314: Unsupported PayPal signature algorithm accepted XenForo before 2.3.13 fails open when a PayPal REST webhook names an unsupported signature algorithm. What happens The webhook handler maps PAYPAL-AUTH-ALGO through a small allowlist. If the value is unknown, the mapped algorithm...

CVE-2026-73316

CVE-2026-73316: PayPal webhook replay XenForo before 2.3.13 processes the same valid PayPal REST webhook more than once. What happens The PayPal REST provider overrides XenForo's base transaction validator but omits its duplicate transaction-log lookup. The database index is also non-unique. Two...

CVE-2026-73320

CVE-2026-73320: Unauthenticated unfurl result disclosure XenForo before 2.3.13 exposes pending rich-link previews through an unauthenticated endpoint keyed by predictable integer IDs. What happens unfurl.php accepts a POST containing global UnfurlResult IDs, loads those rows, and returns rendered...

CVE-2026-74239

CVE-2026-74239: Windows path traversal in style archive import XenForo before 2.3.13 is vulnerable to path traversal in style archive imports on Windows. What happens The importer accepts ZIP members under upload/ and rejects names containing the forward-slash form /../. It does not normalize or...

CVE-2026-73319

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

CVE-2026-73318

XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation...

CVE-2026-73321

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...

CVE-2026-74239

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

CVE-2026-73317

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...