CVE-2026-73312

The record

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.

Affected packages

Related vulnerabilities

• CVE-2026-87952 Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service… CWE-294
• CVE-2026-88278 GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce… CWE-294
• CVE-2026-55250 Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0… CWE-294
• CVE-2026-73311 XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that… CWE-294
• CVE-2026-86219 Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed… CWE-294
• CVE-2026-53636 Open edX Platform enables the authoring and delivery of online learning at any scale. CWE-294
• CVE-2026-12704 When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips… CWE-294
• CVE-2026-84306 Filament is a collection of full-stack components for accelerated Laravel development. CWE-294