CVE-2026-73311
High · 7.4CVSS
7.4
EPSS
0.5%
Published
Sep 8, 2026
CISA due date
—
The record
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87952 Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service… CWE-294
- CVE-2026-88278 GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce… CWE-294
- CVE-2026-55250 Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0… CWE-294
- CVE-2026-73312 XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers… CWE-294
- CVE-2026-86219 Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed… CWE-294
- CVE-2026-53636 Open edX Platform enables the authoring and delivery of online learning at any scale. CWE-294
- CVE-2026-12704 When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips… CWE-294
- CVE-2026-84306 Filament is a collection of full-stack components for accelerated Laravel development. CWE-294