Xenforo EUVD-2025-209152

The CVSS 4.0 score of 9.3 reflects critical severity with maximum exploitability characteristics: network-accessible attack vector (AV:N), low attack complexity (AC:L), no attack requirements (AT:N), no privileges required (PR:N), and no user interaction needed (UI:N). The vulnerability enables complete compromise of confidentiality, integrity, and availability (VC:H/VI:H/VA:H) for the vulnerable system. Real-world risk is elevated because authentication bypass vulnerabilities are high-value targets and passkey implementations are relatively new, meaning exploitation techniques may not require sophisticated tooling. However, risk is somewhat mitigated by the specific requirement that target accounts must have passkeys enabled, limiting the attack surface to a subset of users. Without EPSS data or KEV listing, exploitation likelihood in the wild cannot be quantified, but the combination of unauthenticated remote access, low complexity, and authentication bypass classification makes this a priority remediation target for any XenForo deployment using passkey authentication.

An attacker identifies a XenForo forum running a vulnerable version and enumerates user accounts that have passkeys enabled through registration patterns or public profile information. Exploiting the authentication bypass vulnerability, the attacker crafts malicious authentication requests that circumvent proper passkey validation, allowing them to authenticate as the target user without possessing their private key or device. Once authenticated, the attacker gains complete access to the victim's account, including private messages, administrative capabilities if the account has elevated privileges, and the ability to modify account settings or post content as the compromised user. The attack requires no user interaction and can be automated to target multiple accounts across vulnerable XenForo installations.