What’s Vulnerable › Vulnerabilities

CVE-2026-73312: XenForo < 2.3.13 Refresh Token Replay via Expired Access Token

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-08 · updated 2026-09-11
• Weakness: CWE-294

Description

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.

Affected products

• XenForo: before 2.3.13 — fixed in 2.3.13

How to fix

Upgrade to a fixed version: XenForo 2.3.13. Check the vendor advisory for mitigations.

References

• https://bombobombone.github.io/posts/cve-2026-73312/
• https://github.com/BomboBombone/CVE-2026-73312
• https://www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-token
• https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
• https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/

Get alerted when CVE-2026-73312 or the next vulnerability affects your stack