XenForo CVE-2026-73311

Exploitation requires the attacker to possess a valid OAuth2 authorization code that has already been redeemed once by the legitimate client, then submit it again to XenForo's token endpoint before/alongside normal use; the server's failure to consume the code yields a duplicate token pair for the same user and scopes. Limiting factors: the target must have the OAuth2 authorization-code flow in use, the attacker must first capture a used code (via interception, log/redirect leakage, or a malicious client), and CVSS AC:H reflects this non-default, capture-dependent precondition. No authentication is required to redeem the captured code (PR:N) and no user interaction is needed at redemption time (UI:N).

The vendor CVSS 4.0 base score is 9.1 with AV:N/AC:H/AT:N/PR:N/UI:N and high confidentiality and integrity impact to the vulnerable system (VC:H/VI:H, VA:N). The AC:H is significant and honest: successful replay presumes the attacker has first obtained a valid, already-used authorization code (e.g. via interception, log exposure, a malicious/compromised client, or a redirect-URI leak), which is a non-trivial precondition rather than a spray-and-pray remote exploit. There is no KEV listing and no public exploit identified, so real-world exploitation is not yet evidenced; the reporter is VulnCheck, a credible source. Net: a genuine account-compromise-class authentication weakness worth prompt patching, but the required prior capture of an auth code and high attack complexity make it more targeted than opportunistic - its severity ceiling depends on how easily codes leak in a given deployment.

An attacker who observes or recovers a used OAuth2 authorization code - for example from a leaked redirect URL, proxy/server log, or a compromised OAuth client - resubmits that code to XenForo's token endpoint after the legitimate exchange has already occurred. The server issues a second, independent access/refresh token pair for the victim's account and scopes, giving the attacker durable authorized access. No public exploit code is currently identified, and the AC:H rating reflects the need to first obtain a valid code.