CVE-2026-73309 — XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submittin…
Published: 2026-09-08 · CVSS: 9.1 · CVSS 4.0
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7