EUVD-2025-209150
GHSA-499p-g3jm-62mp
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Description
XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.
Analysis
OAuth2 scope enforcement vulnerability in XenForo 2.3.x (prior to 2.3.5) allows authenticated client applications to request and obtain unauthorized scopes, escalating access beyond intended authorization levels. This authentication bypass flaw (CWE-863) enables malicious OAuth2 clients to gain elevated privileges to user data and platform functions. CVSS 8.7 (High) reflects the network-accessible attack vector with low complexity, though requires low-level privileges (authenticated OAuth client). No public exploit identified at time of analysis, with EPSS data unavailable for recent CVE.
Technical Context
XenForo is a PHP-based forum and community software platform. This vulnerability affects the OAuth2 authorization framework implementation in versions 2.3.0 through 2.3.4. OAuth2 uses scope parameters to define the extent of access granted to client applications (e.g., read-only profile access vs. full account control). The underlying flaw is an authorization enforcement weakness (CWE-863: Incorrect Authorization), where the server fails to properly validate requested scopes against the client's permitted scope whitelist during the authorization flow. This allows a compromised or malicious OAuth2 client application-already registered with limited permissions-to request and receive broader scopes during token exchange, effectively bypassing the principle of least privilege. Affected product per CPE: XenForo versions prior to 2.3.5 (cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*).
Affected Products
This vulnerability affects XenForo forum software versions 2.3.0 through 2.3.4 (all releases in the 2.3 branch prior to 2.3.5). The CPE identifier cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:* confirms the vendor and product. Only customers who have enabled and registered OAuth2 client applications are at risk; default installations without configured OAuth clients are not exploitable. The vendor advisory at https://xenforo.com/community/threads/xenforo-2-3-5-includes-security-fix-add-ons-released.228812/ confirms the scope of impact across the 2.3 series.
Remediation
Upgrade immediately to XenForo version 2.3.5, which includes a security patch addressing the OAuth2 scope validation flaw. The vendor released this patch as part of a coordinated security update documented at https://xenforo.com/community/threads/xenforo-2-3-5-includes-security-fix-add-ons-released.228812/. No workarounds are published; patching is the only confirmed mitigation. As an interim risk reduction measure, administrators should audit all registered OAuth2 client applications, revoke credentials for untrusted or unnecessary clients, and review application logs for anomalous scope requests. Post-upgrade, regenerate OAuth2 client secrets as a precautionary measure to invalidate any tokens potentially issued with excessive scopes prior to patching. Detailed security advisory available at https://www.vulncheck.com/advisories/xenforo-oauth2-unauthorized-scope-request.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today