EUVD-2026-72780
GHSA-pr5w-fh2v-7c9q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid OAuth2 authorization code
-
DeliveryPOST to token endpoint with empty client_secret and code_verifier
-
ExploitPHP truthy check skips secret and PKCE validation
-
ExecutionServer issues valid token pair
-
ImpactAccess victim's authorized scope
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect comparison
|
| Exploitation Conditions | Exploitation requires XenForo's OAuth2 authorization server to be in use and its token endpoint reachable, plus the attacker must possess a valid, unexpired authorization code issued for a target client (typically a confidential client using a secret and/or a public client using PKCE). Given that code, the attack itself needs no authentication, no client secret, and no PKCE code_verifier - the attacker submits empty strings for both, exploiting PHP's treatment of '' as false. Limiting factors: an authorization code must first be obtained (the source of the CVSS AC:H), the OAuth2 provider feature must be enabled/exposed, and the affected instance must be running a version before 2.3.13 (or an unpatched 2.2.x build). |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) scores 9.1 and is internally consistent: network-reachable, unauthenticated, high confidentiality and integrity impact, no availability impact. The AC:H is meaningful - the attacker still needs a valid, unexpired authorization code for a target client/user, which is a genuine precondition, not a trivial default-config attack; this tempers the raw 9.1. No EPSS score, no KEV listing, and no POC flag were provided, so there is currently no evidence of active or automated exploitation - this reads as a high-severity but not yet demonstrably-exploited issue. The realistic priority is high for any internet-facing XenForo instance that uses its OAuth2 provider features (e.g., third-party app integrations), and lower for forums that do not expose the OAuth2 token endpoint to relying parties. |
| Exploit ScenarioDerived | An attacker who observes or obtains a victim's OAuth2 authorization code (for example via a redirect leak, referer, or an authorization-code-injection position) sends a POST to the XenForo token endpoint with that code but empty client_secret and code_verifier fields. The server's truthy checks skip both client authentication and the PKCE verifier comparison and return a valid access/refresh token pair, granting the attacker the victim's authorized scope. No public POC is confirmed at time of analysis, and the AC:H rating reflects the need for a valid code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code for a real access/refresh token pair by submitting empty client_secret and code_verifier values at the token endpoint. Because PHP treats empty strings as falsy, both client-secret verification and PKCE code-verifier checks are silently skipped, defeating client authentication and the PKCE binding. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and no EPSS or KEV signal was supplied.
RemediationAI
Vendor-released patch: upgrade to XenForo 2.3.13, or apply the corresponding backported security release on the 2.2.x line as described at https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/ and https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/. If immediate patching is not possible, restrict or disable the OAuth2 provider/token endpoint if the site does not rely on third-party OAuth integrations (trade-off: breaks any legitimate connected apps), and place the endpoint behind a WAF rule that rejects token requests carrying empty client_secret or code_verifier parameters (trade-off: brittle and easy to bypass with subtle malformations). Additionally shorten authorization-code lifetimes and rotate any client secrets after patching, since previously issued codes may have been redeemable. Verify remediation against the VulnCheck advisory at https://www.vulncheck.com/advisories/xenforo-authentication-bypass-via-oauth2-token-endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
XenForo is a commercial PHP-based community forum platform (cpe:2.3:a:xenforo:xenforo) that ships an OAuth2/OpenID-style authorization server. The flaw is an instance of CWE-697 (Incorrect Comparison): the token-endpoint code path validates the client secret and the PKCE code_verifier using PHP truthiness rather than strict presence/equality checks. In PHP, an empty string ('') evaluates as false, so a conditional guarding secret validation and PKCE commitment verification is short-circuited when the attacker sends empty parameters. PKCE (RFC 7636) exists precisely to bind an authorization code to the party that initiated the flow; skipping the code_verifier check breaks that binding, and skipping client_secret validation breaks confidential-client authentication, so a stolen or observed authorization code alone becomes sufficient to mint tokens.
Know when Xenforo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network, unauthenticated, but requires possessing a valid authorization code (AC:H); token issuance yields high confidentiality and integrity impact with no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment.
Articles & Coverage 2
Executive ViewAI
XenForo community platforms before version 2.3.13 contain a critical authentication flaw enabling unauthorized users to fraudulently obtain legitimate access tokens and sessions, bypassing OAuth2 client authentication and PKCE verification mechanisms. This exposes all user accounts in affected deployments to account takeover and unauthorized access to forum content. A vendor patch is available and immediate deployment is critical.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Xenforo before 2.2.16 allows code injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Xenforo before 2.2.16 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authen
Authentication bypass in XenForo versions prior to 2.3.7 compromises passkey-based authentication, allowing remote unaut
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored**
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertisi
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signa
Unauthorized subscription upgrades in XenForo before 2.3.13 are achievable by replaying valid PayPal REST webhook payloa
Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators
Remote code execution in XenForo versions before 2.3.7 allows authenticated users to invoke unauthorized methods through
OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to req
XenForo forum software versions prior to 2.3.7 disclose server filesystem paths through exception messages triggered by
Exploit-DB