CVE-2026-73314
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Sep 8, 2026
CISA due date
—
The record
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. When the algorithm cannot be mapped to a supported hash function, the verification function incorrectly returns true instead of failing, causing the caller to treat the fabricated request as verified and process the payment event without a valid PayPal signature.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-100352 kin-openapi is a Go project for handling OpenAPI files. CWE-754
- CVE-2026-98161 In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep… CWE-754
- CVE-2026-77411 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-754
- CVE-2026-87645 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed… CWE-754
- CVE-2026-87548 Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a… CWE-754
- CVE-2026-87532 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed… CWE-754
- CVE-2026-85014 undici's experimental WebSocketStream client crashes the whole Node.js process when a… CWE-754
- CVE-2026-55484 ALOS HTTP is a Linux-first Go web framework and application server built around a custom… CWE-754