CVE-2026-73312
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- CWE
- CWE-294
- Published
- 2026-09-08
- Last modified
- 2026-09-09
Affected products
- XenForo XenForo
Weakness type
Related vulnerabilities
- CVE-2026-55250 — Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
- CVE-2026-84003 — Microsoft Authentication Library (MSAL) for Node.js Spoofing Vulnerability
- CVE-2026-69676 — Windows Kerberos Remote Code Execution Vulnerability
- CVE-2026-73311 — XenForo < 2.3.13 OAuth2 Authorization Code Reuse
- CVE-2022-51016 — PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay
- CVE-2026-86219 — Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step
- CVE-2026-75034 — Rancher: SAML Assertion Replay
- CVE-2026-53636 — Open edX LTI OAuth Replay Attack