EUVD-2025-209152
GHSA-gqgm-83rg-vhcj
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Description
XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of Passkey-based authentication.
Analysis
Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unauthenticated attackers to bypass security controls protecting passkey-enabled user accounts. No public exploit identified at time of analysis, though EPSS data not available. The vulnerability affects a critical authentication mechanism (WebAuthn/passkeys), representing a high-severity threat to forum platforms relying on this modern authentication method.
Technical Context
XenForo is a commercial forum software platform that implemented passkey support for WebAuthn-based passwordless authentication. This vulnerability is classified as CWE-287 (Improper Authentication), indicating a fundamental flaw in how the platform validates passkey authentication attempts. Passkeys leverage public key cryptography where the private key remains on the user's device and the public key is stored server-side. The vulnerability suggests improper validation of the authentication ceremony, signature verification, or challenge-response mechanism, potentially allowing attackers to authenticate as passkey-enabled users without possessing the legitimate credential. The affected product is identified by CPE cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*, indicating all XenForo versions prior to the patched release are vulnerable.
Affected Products
XenForo forum software versions prior to 2.3.7 are affected (CPE: cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*). The vulnerability specifically impacts installations where users have added passkeys to their accounts for WebAuthn-based authentication. The vendor advisory is available at https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/ and additional analysis from VulnCheck can be found at https://www.vulncheck.com/advisories/xenforo-passkey-security-bypass.
Remediation
Vendor-released patch: XenForo 2.3.7. Administrators should immediately upgrade all XenForo installations to version 2.3.7 or later, which includes security fixes addressing the passkey authentication bypass. The official vendor advisory with upgrade instructions is available at https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/. As an interim measure if immediate patching is not feasible, administrators may consider temporarily disabling passkey authentication functionality until the upgrade can be completed, though this should be balanced against user experience impacts. Review authentication logs for any suspicious passkey authentication attempts prior to patching, particularly successful logins for passkey-enabled accounts during unusual timeframes or from unexpected locations.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today