Which versions of Xenforo are affected by EUVD-2025-209150?

XenForo 2.3.x contains an OAuth2 scope enforcement flaw (CVE-2025-71278) that allows authenticated third-party applications to escalate privileges and access user data and platform functions beyond…. A patch is available.

How to fix or mitigate EUVD-2025-209150?

Within 24 hours: Inventory all XenForo 2.3.x instances and identify active OAuth2 client integrations. Within 7 days: Apply vendor patch to upgrade XenForo to version 2.3.5 or later on all affected systems; audit OAuth2 client permissions post-patch. Within 30 days: Conduct access review of all OAuth2 applications with historical scope requests; revoke credentials for unused or untrusted clients; implement additional OAuth2 scope validation logging.

Xenforo EUVD-2025-209150

Q: What is the CVSS score of EUVD-2025-209150?

EUVD-2025-209150 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2025-71278 HIGH

Incorrect Authorization (CWE-863)

2026-04-01 VulnCheck

GHSA-499p-g3jm-62mp

Authentication Bypass Xenforo

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:09 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.3.5

EUVD ID Assigned

Apr 01, 2026 - 01:15 euvd

EUVD-2025-209150

Analysis Generated

Apr 01, 2026 - 01:15 vuln.today

CVE Published

Apr 01, 2026 - 00:30 nvd

HIGH 8.7

DescriptionCVE.org

XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.

AnalysisAI

OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to request and obtain unauthorized scopes, escalating access beyond intended authorization levels. This authentication bypass flaw (CWE-863) enables malicious OAuth2 clients to gain elevated privileges to user data and platform functions. CVSS 8.7 (High) reflects the network-accessible attack vector with low complexity, though requires low-level privileges (authenticated OAuth client). No public exploit identified at time of analysis, with EPSS data unavailable for recent CVE.

Technical ContextAI

XenForo is a PHP-based forum and community software platform. This vulnerability affects the OAuth2 authorization framework implementation in versions 2.3.0 through 2.3.4. OAuth2 uses scope parameters to define the extent of access granted to client applications (e.g., read-only profile access vs. full account control). The underlying flaw is an authorization enforcement weakness (CWE-863: Incorrect Authorization), where the server fails to properly validate requested scopes against the client's permitted scope whitelist during the authorization flow. This allows a compromised or malicious OAuth2 client application-already registered with limited permissions-to request and receive broader scopes during token exchange, effectively bypassing the principle of least privilege. Affected product per CPE: XenForo versions prior to 2.3.5 (cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*).

RemediationAI

Upgrade immediately to XenForo version 2.3.5, which includes a security patch addressing the OAuth2 scope validation flaw. The vendor released this patch as part of a coordinated security update documented at https://xenforo.com/community/threads/xenforo-2-3-5-includes-security-fix-add-ons-released.228812/. No workarounds are published; patching is the only confirmed mitigation. As an interim risk reduction measure, administrators should audit all registered OAuth2 client applications, revoke credentials for untrusted or unnecessary clients, and review application logs for anomalous scope requests. Post-upgrade, regenerate OAuth2 client secrets as a precautionary measure to invalidate any tokens potentially issued with excessive scopes prior to patching. Detailed security advisory available at https://www.vulncheck.com/advisories/xenforo-oauth2-unauthorized-scope-request.