CVE-2026-73310: Xenforo

Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days.

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.

Affected products

• Xenforo Xenforo: before 2.3.13 (fixed in 2.3.13)

Published 2026-09-08. Last modified 2026-09-11.