XenForo CVE-2026-73319

Exploitation requires an authenticated XenForo user to click a crafted Follow action URL provided by the attacker - the victim must be logged in and must interact with the link (UI:A). The attacker requires no authentication or privileges on the XenForo instance. The vulnerability is inherent to the default dynamic redirect handler present in all XenForo versions before 2.3.13; no non-default configuration is needed. The effective limiting factors are: (1) the victim must be an authenticated forum member at the time of the click, and (2) the attacker must deliver the malicious link through a social engineering channel (private message, external site, etc.). There is no exploit path that bypasses these conditions - unauthenticated users triggering the XSS against other users is not possible without the authenticated Follow action as a trigger.

The CVSS 4.0 score of 5.1 accurately reflects a meaningful but constrained threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) shows no attacker privileges required, but user interaction is mandatory - specifically an authenticated XenForo member must trigger the Follow action via the crafted link. The impact metrics (VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) indicate limited downstream confidentiality and integrity effects, consistent with a client-side XSS that does not directly compromise the server. No EPSS data was provided and no CISA KEV listing exists, making real-world exploitation likelihood difficult to quantify independently. The bypass technique (percent-encoded newlines + URI authority abuse) is technically non-trivial but well-documented in research, meaning motivated attackers with familiarity of URI parsing could operationalize it. The primary risk is session hijacking or CSRF-like action execution against authenticated forum members, not server compromise. Risk is proportional to the forum's attack surface and value of authenticated user sessions.

An attacker constructs a XenForo Follow action URL with a redirect parameter set to a javascript: URI that embeds the board hostname in the authority component (e.g., javascript://forum.victim.org/%0aalert(document.cookie)) and distributes the link to authenticated forum members via a private message, external site, or forum post. When a victim with an active session clicks the link and completes the Follow action, the redirect handler validates the hostname as legitimate but the browser interprets the URI as executable JavaScript, running the attacker's payload under the board origin. The attacker can then exfiltrate session tokens or perform privileged actions on the victim's behalf. No public proof-of-concept code has been identified, but the bypass technique is well-known in security research.