CVE-2026-73312 in XenForo
Summary
by MITRE • 09/08/2026
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in XenForo versions prior to 2.3.13 represents a critical authentication flaw rooted in improper session management and state handling within the OAuth-like token exchange mechanism. Specifically, this is a refresh token replay attack where the application fails to enforce the one-time use property of refresh tokens under specific conditions involving access token expiration. In standard secure implementations, when an application receives a refresh token to obtain a new pair of access and refresh tokens, it must immediately invalidate or mark the original refresh token as consumed in its backend storage. This ensures that even if an attacker intercepts the token via network sniffing or cross-site scripting, they cannot reuse it indefinitely. However, in this specific scenario, XenForo exhibits a logic error where the system does not properly track the consumption status of the parent refresh token when the associated access token has already expired.
From a technical perspective, the flaw allows an attacker to submit the same stolen or intercepted refresh token multiple times against the authentication endpoint. Because the application fails to check if that specific refresh token instance has already been used in previous successful exchanges, it generates new, independent pairs of access and refresh tokens for each submission. This behavior effectively extends the validity period of the compromised credentials beyond their intended lifespan. Instead of a single use leading to immediate invalidation, the attacker can repeatedly cycle through this process, generating fresh session cookies or API keys that remain valid until the original token's absolute expiration time is reached. This transforms what should be a transient compromise into persistent unauthorized access, allowing the adversary to maintain control over the victim account for an extended duration without needing further interaction with the authentication system.
The operational impact of this vulnerability is severe, particularly in environments where session hijacking or credential theft occurs through man-in-the-middle attacks, malicious browser extensions, or cross-site scripting vectors. An attacker who obtains a refresh token can leverage it to continuously authenticate as the victim user, bypassing standard security controls that rely on single-use tokens for revocation. This persistence enables long-term data exfiltration, unauthorized administrative actions if the compromised account has elevated privileges, and potential lateral movement within the application ecosystem. For community platforms like XenForo, this could lead to significant reputational damage, loss of user trust, and compliance violations related to data protection standards such as GDPR or CCPA due to unauthorized access to personal information stored in forum posts and private messages.
This vulnerability aligns with CWE-294, which describes the Improper Authentication: Accepting a Duplicate Credential for Concurrent Sessions, although it is more accurately characterized by CWE-613, Insufficient Session Expiration, combined with aspects of CWE-384, Session Fixation, due to the failure to invalidate previous tokens. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1528, Steal Application Access Token, specifically within the context of token replay and persistence mechanisms. The lack of proper state management for refresh tokens is a common pitfall in OAuth 2.0 implementations where developers may incorrectly assume that access token expiration provides sufficient protection without enforcing strict one-time-use policies on the underlying refresh mechanism.
To mitigate this vulnerability, administrators must upgrade XenForo to version 2.3.13 or later, which addresses the logic error by ensuring that every successful use of a refresh token results in its immediate invalidation and replacement with a new pair. This enforces the principle that each refresh token is valid for exactly one exchange after issuance. Additionally, developers should implement robust logging mechanisms to detect unusual patterns of token usage, such as multiple rapid requests using the same refresh token from different IP addresses or user agents, which could indicate an ongoing replay attack even in patched systems if other vectors exist. Security best practices also dictate that applications should validate not only the expiration time but also the unique identifier and consumption status of tokens at every step of the authentication flow to prevent state manipulation attacks.